eslint-plugin-node-security 4.4.3 → 4.6.0

package/CHANGELOG.md

@@ -1,4 +1,120 @@
-## [4.1.0] - 2026-05-03
+## 4.6.0
+
+### Minor Changes
+
+- [#305](https://github.com/ofri-peretz/eslint/pull/305) [`8f1c9ef`](https://github.com/ofri-peretz/eslint/commit/8f1c9efbe99c592f8ed5ffca2d1ed8f53408af19) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - New rule `no-unsafe-buffer-alloc` (CWE-908, Use of Uninitialized Resource) —
+  closes a measured coverage gap against `security-node/detect-buffer-unsafe-allocation`
+  and `@microsoft/eslint-plugin-sdl/no-unsafe-alloc`.
+
+  It reports `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, both of which
+  return memory that was never zeroed, with a suggestion to swap in
+  `Buffer.alloc()`. Neither the existing `no-deprecated-buffer` (deprecated
+  `Buffer()` constructor, CWE-676) nor `no-buffer-overread` (read-side CWE-126)
+  flagged the allocation itself.
+
+  **The rule is unconditional and does no dataflow** — it does not try to prove
+  the buffer is fully overwritten before it is read, so a correct
+  `allocUnsafe` + `copy` pair is still reported. The one structural exemption is
+  `Buffer.allocUnsafe(n).fill(0)`, a parent-node check rather than variable
+  tracking. Because of that false-positive profile it ships as `warn` in
+  `recommended` rather than `error` (upstream `security-node` ships its
+  equivalent off by default).
+
+### Patch Changes
+
+- [#317](https://github.com/ofri-peretz/eslint/pull/317) [`5a8456b`](https://github.com/ofri-peretz/eslint/commit/5a8456b08ffa567be73a66393758ed17805e2fe4) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - `no-ssrf`: recognise `needle` as an HTTP client, so `needle.get(req.query.url)` reports. The verb-first `needle('get', url)` form is still not covered — the rule only inspects the first argument.
+
+- Updated dependencies [[`09d2951`](https://github.com/ofri-peretz/eslint/commit/09d2951b3ac74efc9ba49b64e9089d66800b16cc)]:
+  - @interlace/eslint-devkit@1.4.4
+
+## 4.5.0
+
+### Minor Changes
+
+- [#310](https://github.com/ofri-peretz/eslint/pull/310) [`28d7898`](https://github.com/ofri-peretz/eslint/commit/28d789896b06dd13ac7c50bcb4aaa36fa5e4be29) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Add `no-timing-unsafe-compare` to the `recommended` preset, restoring CWE-697
+  coverage.
+
+  `secure-coding/no-insecure-comparison` was removed from every `secure-coding`
+  preset, with `node-security/no-timing-unsafe-compare` named as the replacement.
+  But that rule was not in any `recommended` preset, so the practical result was
+  that **no `recommended` preset anywhere covered CWE-697 timing-unsafe
+  comparison**, and the migration note pointed users at a rule they would have had
+  to enable by hand — which the note did not say.
+
+  It enters at `'warn'` rather than `'error'`, matching the precedent already set
+  by `no-deprecated-buffer` in this preset: adopters shouldn't have CI turn red on
+  a version bump. Promote to `'error'` on the next major.
+
+  Note the coverage now lives in a different package than before. A project that
+  installs only `eslint-plugin-secure-coding` and relied on its presets for this
+  check needs `eslint-plugin-node-security` as well.
+
+  A lock test in `src/index.test.ts` fails if the rule leaves `recommended` again,
+  since that would silently make the migration note false.
+
+- [#288](https://github.com/ofri-peretz/eslint/pull/288) [`89bea05`](https://github.com/ofri-peretz/eslint/commit/89bea05c6c48f5f1bdbcc3c87b301d967d962051) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut false positives in five security rules, measured against a 1,470-file corpus (webpack `lib/`, lodash, eslint-plugin-import `src/`, and two NestJS boilerplates).
+
+  **`secure-coding/no-hardcoded-credentials` — decide on the value, not the key name.** The rule reported any string in a credential-named slot, so `errors: { password: 'incorrectPassword' }` (an i18n error key) was a CVSS 9.8 finding — 5 of its 10 corpus hits. Detection is now driven by the value's shape: entropy, character-class mix, charset, and a "natural word string" test that rejects identifier- and message-shaped values. A credential-shaped name is still consulted, but only to promote an already-secret-shaped value. Corpus: **10 → 7 findings, and all 7 are true positives** — including two the old logic missed, because a 25-character random `key:` is now found by shape rather than by being on a name allowlist.
+
+  **`secure-coding/no-unsafe-deserialization` — `setTimeout` is not a deserializer.** `await new Promise(resolve => setTimeout(resolve, 1000))` was rated CVSS 9.8 CRITICAL. `setTimeout` / `setInterval` now only report in their implied-`eval` form (string first argument), and calls inside a function named `deserialize` / `unserialize` / `fromJSON` / `fromBuffer` — a class implementing a serialization protocol — are exempt. Corpus: **35 → 4**.
+
+  **`secure-coding/no-graphql-injection` — require real GraphQL syntax.** Any template literal containing a nested brace or the word `type` was a CVSS 9.8 GraphQL injection. Operation and schema keywords must now start a line, schema keywords require a body, and a bare selection set must be the entire string. Concatenations are matched on their reassembled static value rather than on their source text. Corpus: **41 → 0**.
+
+  **`node-security/require-secure-deletion` — only sensitive properties.** The rule fired on every `delete obj.prop`. It now reports only a statically known, sensitive property name (`password`, `token`, `apiKey`, `privateKey`, `sessionId`, …), configurable via the new `additionalSensitiveProperties` option, and understands computed access and optional chaining. Corpus: **25 → 1** (a genuine `delete userDto.oldPassword`).
+
+  **`secure-coding/no-insecure-comparison` — removed from `recommended`, `recommended-strict` and `owasp-top-10`.** It is deprecated in favour of `node-security/no-timing-unsafe-compare`, and its loose-equality half re-reports core `eqeqeq` under a CWE-697 banner — 433 corpus findings, all duplicates. No narrowing fixes that, so the honest change is to stop switching it on for people; it remains exported and available via `strict` or explicit opt-in. Its timing-attack half was also narrowed to match secret keywords on identifier **word segments** instead of substrings of the whole expression text, which stops `if (key === "__non_webpack_require__")` (and `monkey`, `keyword`, `machine`, `author`) from being reported: **443 → 221**.
+
+### Patch Changes
+
+- [#294](https://github.com/ofri-peretz/eslint/pull/294) [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Rewrite `description` and `keywords` on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.
+
+  **Descriptions now lead with the search phrase.** Every one starts `ESLint plugin for <the thing you'd search>` instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:
+
+  - `eslint-plugin-import-next` claimed "100x faster no-cycle detection". No 100x measurement exists: `CLAIMS.md` records **3.1x end-to-end** (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
+  - `eslint-plugin-secure-coding` claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
+  - `eslint-plugin-secure-coding` ("89 rules") and `eslint-plugin-react-a11y` ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into `interlace-numbers.json`; hand-typed copies are removed rather than corrected.
+
+  **Keywords now match the vocabulary of the plugins that rank.** `eslint-plugin-security`, `eslint-plugin-jsx-a11y`, `eslint-plugin-n` and `eslint-plugin-import` all carry the `eslint` / `eslintplugin` / `eslint-plugin` trio — six of our packages were missing `eslintplugin`, and every one now carries all three plus `static-analysis`, `linting` and `code-quality`. Security plugins add `sast`, `appsec` and `vulnerability`; `node-security` and `secure-coding` also carry `nodesecurity`, the exact keyword `eslint-plugin-security` ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (`cwe-78` command injection, `cwe-22` path traversal, `cwe-89` SQL injection, `cwe-79` XSS, `cwe-347` JWT algorithm confusion, `cwe-352` CSRF, `cwe-943` NoSQL injection), and `node-security` gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (`crypto`, `cryptography`, `weak-hash`, `md5`, `sha1`, `timing-attack`).
+
+  No rule behavior, exports, or configuration changes.
+
+- [#296](https://github.com/ofri-peretz/eslint/pull/296) [`0c7a208`](https://github.com/ofri-peretz/eslint/commit/0c7a208f568436cc55ac6732641df46e8f44af1f) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut two false positives confirmed against the benchmark corpus SAFE fixtures.
+
+  **`node-security/no-ssrf`** — the user-input gate only ran when the URL argument
+  was a bare identifier, so every other shape reported unconditionally. A Node
+  options object built from a helper's own parameters —
+  `https.request({ host, path, method: 'GET' })`, from
+  `benchmarks/corpus/CWE-444/safe/request-default-parser.js` — was flagged with no
+  user data anywhere in the flow.
+
+  The gate now applies to every argument shape and requires evidence: a
+  user-input-named identifier standing as the URL, a read off a request object
+  (`req` / `request` / `ctx` / `event`), or a template literal or concatenation
+  interpolating either. Options-object fields count when they are request-sourced,
+  or when a `url` / `href` / `uri` key holds a user-input-named identifier.
+
+  Newly ignored: options objects and interpolations built purely from locals.
+  Still reported: `fetch(userUrl)`, `fetch(req.query.url)`,
+  `https.request({ host: req.query.host })`, ``fetch(`https://${userHost}/x`)``.
+
+  **`secure-coding/no-hardcoded-credentials`** — `secret: '<your-secret-here>'`
+  from `benchmarks/corpus/CWE-798/safe/test-placeholder-values.js` was reported at
+  CVSS 9.8. The angle brackets are two character classes, which is all the shape
+  gate asks for once the slot is credential-named.
+
+  Self-evident placeholders are now skipped: bracketed template slots (`<…>`,
+  `{{…}}`, `${…}`, `[…]`), placeholder words standing as their own token
+  (`changeme`, `YOUR_API_KEY`, `example`), and one character repeated
+  (`xxxxxxxxxxxx`). Whole-token matching only, so a real secret that merely
+  contains such a substring is unaffected.
+
+  The allowlist applies to non-structural findings only — a JWT, an `sk_live_`
+  key, or a `postgres://user:pass@host` string still reports whatever words it
+  contains. Set the new `allowPlaceholders: false` option to restore the previous
+  behaviour.
+
+- Updated dependencies [[`e1cdf83`](https://github.com/ofri-peretz/eslint/commit/e1cdf83e3db761907f0ab06f7fc6c1f1da7513a5), [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358)]:
+  - @interlace/eslint-devkit@1.4.3
 
 ## 4.4.3
 
@@ -160,6 +276,8 @@
 - Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
   - @interlace/eslint-devkit@1.4.1
 
+## [4.1.0] - 2026-05-03
+
 ### Added
 
 - New rule `no-deprecated-buffer` — flags use of the deprecated `Buffer()` constructor (Node.js security advisory; `Buffer.from`/`Buffer.alloc` should be used instead). Enabled in the `recommended` preset at `warn` to avoid breaking adopters with legacy `Buffer()` calls; will be promoted to `error` in the next major.

package/README.md

@@ -105,6 +105,7 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
 | [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-329 | A02:2021 |  | Disallow static or hardcoded initialization vectors (IVs) | 🟢 |  |  |  |  |  |
 | [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-208 | A02:2021 |  | Disallow timing-unsafe comparison of secrets | 🟢 |  |  |  |  |  |
 | [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-367 | A01:2021 |  | Detects Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerabilities in file system operations. | 🟢 |  |  |  |  |  |
+| [no-unsafe-buffer-alloc](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-buffer-alloc?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-908 | A01:2021 |  | Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory. | 🟢 |  |  |  | 💡 |  |
 | [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-494 |  |  | Disallows dynamic require() calls with non-literal arguments that could lead to security vulnerabilities | 🟢 |  |  |  |  |  |
 | [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish, RC2, IDEA) | 🟢 |  |  |  |  |  |
 | [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow weak hash algorithms (MD5, MD4, SHA-1, RIPEMD) | 🟢 |  |  |  |  |  |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.4.3",
-  "description": "Security-focused ESLint plugin for Node.js built-in modules (fs, child_process, vm, path, Buffer). Detects command injection, path traversal, code execution vulnerabilities with AI-parseable error messages.",
+  "version": "4.6.0",
+  "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -43,38 +43,46 @@
   ],
   "keywords": [
     "eslint",
-    "eslint-plugin",
     "eslintplugin",
-    "interlace-security",
+    "eslint-plugin",
+    "static-analysis",
+    "linting",
+    "code-quality",
     "security",
-    "node-security",
+    "sast",
+    "appsec",
+    "vulnerability",
+    "owasp",
+    "cwe",
+    "interlace-security",
+    "node",
     "nodejs",
-    "child-process",
+    "node-security",
+    "nodesecurity",
     "command-injection",
+    "cwe-78",
     "path-traversal",
-    "fs",
-    "vm",
-    "buffer",
-    "owasp",
-    "cwe",
-    "vulnerability",
+    "cwe-22",
+    "ssrf",
+    "zip-slip",
+    "child-process",
+    "crypto",
+    "cryptography",
+    "weak-hash",
+    "md5",
+    "sha1",
+    "timing-attack",
     "llm-optimized",
     "ai-assistant",
-    "auto-fix",
     "typescript",
-    "linting",
-    "code-quality",
-    "ast",
-    "static-analysis",
-    "mcp",
-    "model-context-protocol"
+    "auto-fix"
   ],
   "engines": {
     "node": ">=18.0.0"
   },
   "dependencies": {
     "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.2"
+    "@interlace/eslint-devkit": "^1.4.4"
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.46.2",

package/src/index.js

@@ -12,6 +12,7 @@ const detect_non_literal_fs_filename_1 = require("./rules/detect-non-literal-fs-
 const no_unsafe_dynamic_require_1 = require("./rules/no-unsafe-dynamic-require");
 const no_buffer_overread_1 = require("./rules/no-buffer-overread");
 const no_deprecated_buffer_1 = require("./rules/no-deprecated-buffer");
+const no_unsafe_buffer_alloc_1 = require("./rules/no-unsafe-buffer-alloc");
 const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
 const no_zip_slip_1 = require("./rules/no-zip-slip");
 const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
@@ -50,6 +51,7 @@ exports.rules = {
     'no-unsafe-dynamic-require': no_unsafe_dynamic_require_1.noUnsafeDynamicRequire,
     'no-buffer-overread': no_buffer_overread_1.noBufferOverread,
     'no-deprecated-buffer': no_deprecated_buffer_1.noDeprecatedBuffer,
+    'no-unsafe-buffer-alloc': no_unsafe_buffer_alloc_1.noUnsafeBufferAlloc,
     'no-toctou-vulnerability': no_toctou_vulnerability_1.noToctouVulnerability,
     'no-zip-slip': no_zip_slip_1.noZipSlip,
     'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
@@ -85,7 +87,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.4.3',
+        version: '4.6.0',
     },
     rules: exports.rules,
 };
@@ -105,6 +107,12 @@ const recommendedRules = {
     // adopters who already use the preset and have legacy `Buffer()` calls.
     // Promote to 'error' on the next major bump.
     'node-security/no-deprecated-buffer': 'error',
+    // Added in 4.5.0. Unconditional flag on `Buffer.allocUnsafe()` — a real but
+    // legitimate performance API — so it ships as 'warn', not 'error'. The rule
+    // does no dataflow, so a correctly-overwritten buffer still reports.
+    // Upstream `security-node/detect-buffer-unsafe-allocation` ships this off by
+    // default; 'warn' is the middle ground.
+    'node-security/no-unsafe-buffer-alloc': 'warn',
     'node-security/no-toctou-vulnerability': 'error',
     'node-security/no-zip-slip': 'error',
     'node-security/no-arbitrary-file-access': 'error',
@@ -112,6 +120,15 @@ const recommendedRules = {
     'node-security/no-ssrf': 'warn',
     'node-security/no-shell-injection': 'error',
     'node-security/no-dynamic-algorithm-selection': 'error',
+    // Added to `recommended` 2026-08-02. `secure-coding/no-insecure-comparison`
+    // was removed from every `secure-coding` preset in favour of this rule, but
+    // this rule was not in any `recommended` preset — so CWE-697 timing-unsafe
+    // comparison had no preset coverage anywhere in the ecosystem, and the
+    // migration note pointed at a rule users would have had to enable by hand.
+    // Enters at 'warn' rather than 'error' for the same reason as
+    // `no-deprecated-buffer` above: adopters already on this preset shouldn't
+    // have CI turn red on a version bump. Promote on the next major.
+    'node-security/no-timing-unsafe-compare': 'warn',
     // Migrated Rules
     'node-security/detect-suspicious-dependencies': 'warn',
     'node-security/lock-file': 'warn', // filesystem check — not pure AST; CI enforces this better

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IAEvD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,2EAAqE;AACrE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,wBAAwB,EAAE,4CAAmB;IAC7C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,6EAA6E;IAC7E,wCAAwC;IACxC,sCAAsC,EAAE,MAAM;IAC9C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,0EAA0E;IAC1E,iEAAiE;IACjE,wCAAwC,EAAE,MAAM;IAEhD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}

package/src/rules/no-ssrf/index.js

@@ -19,8 +19,10 @@ const HTTP_CLIENT_METHODS = new Set([
     'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'request',
 ]);
 // Object names that are HTTP client libraries
+// `needle.get(url)` is covered here; the `needle('get', url)` verb-first form
+// is not — the URL sits in argument 1, and this rule only reads argument 0.
 const HTTP_CLIENT_OBJECTS = new Set([
-    'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici',
+    'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici', 'needle',
 ]);
 // Function names that indicate URL validation
 const VALIDATION_FUNCTION_NAMES = new Set([
@@ -40,6 +42,82 @@ function isUserInputParamName(name) {
     const lower = name.toLowerCase();
     return USER_INPUT_SUBSTRINGS.some(sub => lower.includes(sub));
 }
+// Object roots whose members carry attacker-controlled data in the common
+// server frameworks: Express `req`/`request`, Koa `ctx`, Lambda `event`.
+const REQUEST_ROOT_NAMES = new Set(['req', 'request', 'ctx', 'event']);
+// Keys of a Node `http.request(options)` object that actually name a URL.
+// `host`/`hostname`/`path`/`port` are deliberately absent: a helper that
+// parameterises them is ordinary internal plumbing, not evidence of user flow.
+const URL_OPTION_KEYS = new Set(['url', 'href', 'uri']);
+/**
+ * True when the expression reads off a request object — `req.query.url`,
+ * `ctx.request.body.target`, `event.queryStringParameters.u`. Everything
+ * hanging off a request is untrusted, so the root name is the whole test.
+ */
+function isRequestSourced(node) {
+    let current = node;
+    while (current.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
+        current = current.object;
+    }
+    return (current !== node &&
+        current.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        REQUEST_ROOT_NAMES.has(current.name.toLowerCase()));
+}
+/**
+ * Does the URL argument carry untrusted data into the request?
+ *
+ * The rule reports on evidence of flow, never on the mere presence of a
+ * dynamic argument. Three shapes qualify:
+ *
+ *   1. The whole argument is a user-input-named identifier — `fetch(userUrl)`.
+ *      This is the rule's documented naming heuristic: a bare identifier in
+ *      URL position *is* the URL.
+ *   2. Any part of the expression reads from a request object —
+ *      `fetch(req.query.url)`, `https.request({ host: req.query.h })`.
+ *   3. A template literal URL interpolates either of the above —
+ *      `fetch(\`https://\${userHost}/x\`)`.
+ *
+ * Everything else is not evidence. In particular an options object whose
+ * fields are plain locals — `https.request({ host, path, method: 'GET' })`,
+ * benchmarks/corpus/CWE-444/safe/request-default-parser.js — used to be
+ * reported unconditionally because a non-Identifier argument bypassed the
+ * name gate entirely.
+ */
+function carriesUntrustedUrl(node) {
+    switch (node.type) {
+        case eslint_devkit_1.AST_NODE_TYPES.Identifier:
+            return isUserInputParamName(node.name);
+        case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:
+            return isRequestSourced(node);
+        case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:
+            return node.expressions.some(carriesUntrustedUrl);
+        // `new URL(userUrl)` / `String(req.query.url)` — inspect the arguments.
+        case eslint_devkit_1.AST_NODE_TYPES.CallExpression:
+        case eslint_devkit_1.AST_NODE_TYPES.NewExpression:
+            return node.arguments.some(carriesUntrustedUrl);
+        // `'https://host' + userPath`
+        case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:
+            return carriesUntrustedUrl(node.left) || carriesUntrustedUrl(node.right);
+        // `http.request({ url: x, host: y })` — only URL-naming keys count by
+        // name; every other key still counts if its value is request-sourced.
+        case eslint_devkit_1.AST_NODE_TYPES.ObjectExpression:
+            return node.properties.some(property => {
+                if (property.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
+                    return false;
+                const value = property.value;
+                if (isRequestSourced(value))
+                    return true;
+                const key = property.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
+                    ? property.key.name
+                    : property.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal
+                        ? String(property.key.value)
+                        : '';
+                return URL_OPTION_KEYS.has(key.toLowerCase()) && carriesUntrustedUrl(value);
+            });
+        default:
+            return false;
+    }
+}
 /**
  * AST-based check: does this node contain a validation pattern?
  * Walks the node tree looking for known validation constructs.
@@ -139,7 +217,7 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
         type: 'suggestion',
         docs: {
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md',
-            description: 'Flags HTTP calls whose URL argument is an identifier with a user-input-sounding name — a heuristic prompt for code review, not a proof of SSRF',
+            description: 'Flags HTTP calls whose URL argument is a user-input-named identifier or reads off a request object — a heuristic prompt for code review, not a proof of SSRF',
             cwe: 'CWE-918',
             cvss: 9.1,
         },
@@ -196,26 +274,17 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
                 const urlArg = node.arguments[0];
                 if (!urlArg)
                     return;
-                // Safe: literal string URL — fetch('https://api.example.com')
-                if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal)
-                    return;
-                // Safe: template literal without expressions — fetch(`https://api.example.com`)
-                if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
-                    urlArg.expressions.length === 0) {
-                    return;
-                }
-                // The URL is dynamic (identifier, template with expressions, etc.)
+                // Static URLs — fetch('https://api.example.com'), fetch(`https://…`) —
+                // carry nothing untrusted and fall out at the evidence gate below.
                 // Check if there is URL validation before this call
                 if (hasValidationBefore(node)) {
                     return;
                 }
-                // Check if the argument is a function parameter that looks like user input
-                if (urlArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    // If the variable name doesn't suggest user input, skip
-                    // This reduces false positives on internal API calls
-                    if (!isUserInputParamName(urlArg.name)) {
-                        return;
-                    }
+                // Require evidence that untrusted data reaches the URL. Applies to
+                // every argument shape — an options object or a template literal used
+                // to bypass this gate entirely and report unconditionally.
+                if (!carriesUntrustedUrl(urlArg)) {
+                    return;
                 }
                 context.report({
                     node,

package/src/rules/no-ssrf/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;CACnE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,gJAAgJ;YAClJ,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,8DAA8D;gBAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;oBAAE,OAAO;gBAEnD,gFAAgF;gBAChF,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;oBAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,2EAA2E;gBAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBAC9C,wDAAwD;oBACxD,qDAAqD;oBACrD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;CAC7E,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvE,0EAA0E;AAC1E,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAExD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC1C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,8BAAc,CAAC,UAAU;YAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAEhC,KAAK,8BAAc,CAAC,eAAe;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,wEAAwE;QACxE,KAAK,8BAAc,CAAC,cAAc,CAAC;QACnC,KAAK,8BAAc,CAAC,aAAa;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElD,8BAA8B;QAC9B,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAqB,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5F,sEAAsE;QACtE,sEAAsE;QACtE,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAsB,CAAC;gBAC9C,IAAI,gBAAgB,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzC,MAAM,GAAG,GACP,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;oBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;wBAC5C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC5B,CAAC,CAAC,EAAE,CAAC;gBACX,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QAEL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,8JAA8J;YAChK,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,uEAAuE;gBACvE,mEAAmE;gBAEnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAuB,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/no-unsafe-buffer-alloc/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-unsafe-buffer-alloc
+ *
+ * Detects `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which hand
+ * back a buffer over memory that was never zeroed. Until every byte is
+ * overwritten the buffer contains whatever the allocator last held there —
+ * request bodies, session tokens, private keys. Reading or transmitting it
+ * before it is fully written discloses that memory (CVE-2018-7166 is the
+ * canonical instance of this class in Node itself).
+ *
+ * CWE-908: Use of Uninitialized Resource
+ * OWASP A01:2021 – Broken Access Control
+ *
+ * ## Detection method: structural-api
+ *
+ * Unconditional by design. The rule fires on the AST shape
+ * `<Buffer>.allocUnsafe(...)` / `<Buffer>.allocUnsafeSlow(...)` and performs
+ * **no dataflow or taint analysis** — it does not attempt to prove whether the
+ * buffer is fully overwritten before it is read. Rename every variable in the
+ * file and it reports identically.
+ *
+ * The single structural exemption is a same-expression `.fill()`, e.g.
+ * `Buffer.allocUnsafe(n).fill(0)`, which zeroes the allocation on the spot and
+ * is therefore equivalent to `Buffer.alloc(n)`. That is a parent-node check,
+ * not variable tracking.
+ *
+ * Consequence: a correct `allocUnsafe` immediately overwritten through a
+ * variable (`const b = Buffer.allocUnsafe(n); src.copy(b);`) is still reported.
+ * That is the documented false-positive profile and the reason the rule ships
+ * as `warn` rather than `error` in `recommended`. The complementary CWE-126
+ * read-side analysis lives in `no-buffer-overread`.
+ *
+ * @see https://cwe.mitre.org/data/definitions/908.html
+ * @see https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize
+ * @see https://nvd.nist.gov/vuln/detail/CVE-2018-7166
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'unsafeAlloc' | 'unsafeAllocSlow' | 'useSafeAlloc';
+export declare const noUnsafeBufferAlloc: TSESLint.RuleModule<MessageIds, [], unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export {};

package/src/rules/no-unsafe-buffer-alloc/index.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noUnsafeBufferAlloc = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/** The two uninitialized-memory allocators on `Buffer`. */
+const UNSAFE_ALLOCATORS = new Set(['allocUnsafe', 'allocUnsafeSlow']);
+exports.noUnsafeBufferAlloc = (0, eslint_devkit_1.createRule)({
+    name: 'no-unsafe-buffer-alloc',
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-buffer-alloc.md',
+            description: 'Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory',
+            cwe: 'CWE-908',
+            cweJustification: 'CWE-908 (Use of Uninitialized Resource) — allocUnsafe returns a view over non-zeroed heap memory; any byte not overwritten before the buffer is read or transmitted discloses prior process memory.',
+            cvss: 7.5,
+            confidence: 'high',
+        },
+        messages: {
+            unsafeAlloc: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Uninitialized Buffer Allocation',
+                cwe: 'CWE-908',
+                cvss: 7.5,
+                description: '`Buffer.allocUnsafe(size)` returns memory that has not been zeroed. Every byte not overwritten before the buffer is read or sent leaks whatever the allocator previously stored there.',
+                severity: 'HIGH',
+                fix: 'Use `Buffer.alloc(size)` (zero-filled), or keep `allocUnsafe` only where the very next statement overwrites the whole buffer — `Buffer.allocUnsafe(size).fill(0)` is accepted by this rule.',
+                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize',
+            }),
+            unsafeAllocSlow: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Uninitialized Buffer Allocation (allocUnsafeSlow)',
+                cwe: 'CWE-908',
+                cvss: 7.5,
+                description: '`Buffer.allocUnsafeSlow(size)` allocates outside the shared pool but is equally uninitialized — the returned bytes are whatever was last in that memory.',
+                severity: 'HIGH',
+                fix: 'Use `Buffer.alloc(size)`, or append `.fill(0)` to zero the allocation at the call site.',
+                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafeslowsize',
+            }),
+            useSafeAlloc: 'Replace with `Buffer.alloc()` (zero-filled).',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        /**
+         * True when the call's result is immediately zeroed in the same
+         * expression: `Buffer.allocUnsafe(n).fill(0)`. Parent-node shape only.
+         */
+        function isFilledInPlace(node) {
+            const parent = node.parent;
+            if (parent?.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+                parent.object !== node ||
+                parent.computed ||
+                parent.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                parent.property.name !== 'fill') {
+                return false;
+            }
+            // `.fill` must actually be invoked — `f(buf.fill)` passes the method
+            // around, it does not zero anything.
+            const grandparent = parent.parent;
+            return (grandparent?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                grandparent.callee === parent);
+        }
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+                    callee.computed ||
+                    callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                    callee.object.name !== 'Buffer' ||
+                    callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                    !UNSAFE_ALLOCATORS.has(callee.property.name)) {
+                    return;
+                }
+                if (isFilledInPlace(node))
+                    return;
+                context.report({
+                    node,
+                    messageId: callee.property.name === 'allocUnsafe'
+                        ? 'unsafeAlloc'
+                        : 'unsafeAllocSlow',
+                    suggest: [
+                        {
+                            messageId: 'useSafeAlloc',
+                            fix: (fixer) => fixer.replaceText(callee.property, 'alloc'),
+                        },
+                    ],
+                });
+            },
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-unsafe-buffer-alloc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-unsafe-buffer-alloc/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAwCH,4DAKkC;AAIlC,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEzD,QAAA,mBAAmB,GAAG,IAAA,0BAAU,EAAiB;IAC5D,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE;YACJ,GAAG,EAAE,2HAA2H;YAChI,WAAW,EACT,mGAAmG;YACrG,GAAG,EAAE,SAAS;YACd,gBAAgB,EACd,qMAAqM;YACvM,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,MAAM;SACnB;QACD,QAAQ,EAAE;YACR,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,iCAAiC;gBAC5C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,wLAAwL;gBAC1L,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,6LAA6L;gBAClM,iBAAiB,EACf,wEAAwE;aAC3E,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mDAAmD;gBAC9D,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,0JAA0J;gBAC5J,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,yFAAyF;gBAC9F,iBAAiB,EACf,4EAA4E;aAC/E,CAAC;YACF,YAAY,EAAE,8CAA8C;SAC7D;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ;;;WAGG;QACH,SAAS,eAAe,CAAC,IAA6B;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IACE,MAAM,EAAE,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAChD,MAAM,CAAC,MAAM,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAC/B,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,CACL,WAAW,EAAE,IAAI,KAAK,8BAAc,CAAC,cAAc;gBACnD,WAAW,CAAC,MAAM,KAAK,MAAM,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAAI;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,QAAQ;oBACf,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAClD,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAElC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EACP,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa;wBACpC,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,iBAAiB;oBACvB,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,cAAc;4BACzB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE,CACjC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;yBAC9C;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/require-secure-deletion/index.d.ts

@@ -4,6 +4,11 @@
  * MIT license that can be found in the LICENSE file.
  */
 export interface Options {
+    /**
+     * Extra property-name fragments (case-insensitive substrings) to treat as
+     * sensitive, on top of the built-in list. Default: []
+     */
+    additionalSensitiveProperties?: string[];
 }
 type RuleOptions = [Options?];
 export declare const requireSecureDeletion: import("@typescript-eslint/utils/ts-eslint").RuleModule<"violationDetected", RuleOptions, unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {

package/src/rules/require-secure-deletion/index.js

@@ -12,6 +12,26 @@ exports.requireSecureDeletion = void 0;
  * @see https://cwe.mitre.org/data/definitions/459.html
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/**
+ * Property-name fragments that mark a value as a secret whose lifetime matters.
+ *
+ * `delete` unbinds a property; it does not scrub the string, and every other
+ * reference (a spread copy, a log line, an already-serialised response body)
+ * keeps the value alive. That is the CWE-459 "incomplete cleanup" this rule is
+ * about — and it only means anything when the property actually held a secret.
+ *
+ * Matching is on the property NAME, deliberately: the value at a `delete` site
+ * is not available to a syntactic rule, so the name is the only signal there
+ * is. The cost of that is bounded by keeping this list narrow.
+ */
+const SENSITIVE_PROPERTY_FRAGMENTS = [
+    'password', 'passwd', 'pwd', 'passphrase',
+    'secret', 'apikey', 'api_key',
+    'token', 'jwt', 'bearer',
+    'credential', 'privatekey', 'private_key', 'signingkey', 'signing_key',
+    'sessionid', 'session_id', 'refreshtoken', 'refresh_token',
+    'ssn', 'creditcard', 'credit_card', 'cardnumber', 'card_number', 'cvv',
+];
 exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
     name: 'require-secure-deletion',
     meta: {
@@ -25,23 +45,65 @@ exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
         messages: {
             violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'violation Detected',
+                issueName: 'Incomplete Secret Cleanup',
                 cwe: 'CWE-459',
-                description: 'Require secure data deletion patterns detected - delete without secure wipe',
+                description: '`delete` on the sensitive property `{{property}}` unbinds it without scrubbing the value',
                 severity: 'MEDIUM',
-                fix: 'Review and apply secure practices',
+                fix: 'Overwrite the value before deleting it (obj.{{property}} = undefined, or zero-fill the Buffer), and make sure no copy of the object was spread, logged, or serialised first',
                 documentationLink: 'https://cwe.mitre.org/data/definitions/459.html',
             })
         },
-        schema: [],
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    additionalSensitiveProperties: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Extra property-name fragments to treat as sensitive',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
     },
-    defaultOptions: [],
-    create(context) {
+    defaultOptions: [{ additionalSensitiveProperties: [] }],
+    create(context, [options = {}]) {
+        const { additionalSensitiveProperties = [] } = options;
+        const fragments = [
+            ...SENSITIVE_PROPERTY_FRAGMENTS,
+            ...additionalSensitiveProperties.map((f) => f.toLowerCase()),
+        ];
+        /** The property name being deleted, or undefined if it isn't statically known. */
+        function deletedPropertyName(node) {
+            // `delete obj?.password` wraps the member expression in a ChainExpression.
+            const argument = node.type === 'ChainExpression' ? node.expression : node;
+            if (argument.type !== 'MemberExpression')
+                return undefined;
+            const property = argument.property;
+            if (!argument.computed && property.type === 'Identifier')
+                return property.name;
+            if (argument.computed && property.type === 'Literal' && typeof property.value === 'string') {
+                return property.value;
+            }
+            return undefined;
+        }
         return {
             UnaryExpression(node) {
-                if (node.operator === 'delete') {
-                    context.report({ node, messageId: 'violationDetected' });
-                }
+                if (node.operator !== 'delete')
+                    return;
+                // Only a `delete` of a *named, statically known, sensitive* property is
+                // reportable. Firing on every `delete obj.prop` produced 120 findings
+                // on a 1,470-file corpus with no security content whatsoever — the rule
+                // was a `delete` detector, not a secret-cleanup detector.
+                const property = deletedPropertyName(node.argument);
+                if (!property)
+                    return;
+                const normalized = property.toLowerCase().replace(/[^a-z0-9_]/g, '');
+                if (!fragments.some((fragment) => normalized.includes(fragment)))
+                    return;
+                context.report({ node, messageId: 'violationDetected', data: { property } });
             },
         };
     },

package/src/rules/require-secure-deletion/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/require-secure-deletion/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAUzE,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4HAA4H;YACjI,WAAW,EAAE,uCAAuC;YACpD,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC;SACR;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6EAA6E;gBAC1F,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,OAAO;YAEL,eAAe,CAAC,IAA8B;gBAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/require-secure-deletion/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH;;;;GAIG;AAEH,4DAAsF;AAetF;;;;;;;;;;;GAWG;AACH,MAAM,4BAA4B,GAAG;IACnC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY;IACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS;IAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ;IACxB,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACtE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK;CACvE,CAAC;AAEW,QAAA,qBAAqB,GAAG,IAAA,0BAAU,EAA0B;IACvE,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,4HAA4H;YACjI,WAAW,EAAE,uCAAuC;YACpD,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,CAAC;SACR;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,0FAA0F;gBACvG,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,6KAA6K;gBAClL,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,6BAA6B,EAAE;wBAC7B,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,qDAAqD;qBACnE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,6BAA6B,EAAE,EAAE,EAAE,CAAC;IACvD,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;QAC5B,MAAM,EAAE,6BAA6B,GAAG,EAAE,EAAE,GAAG,OAAkB,CAAC;QAClE,MAAM,SAAS,GAAG;YAChB,GAAG,4BAA4B;YAC/B,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7D,CAAC;QAEF,kFAAkF;QAClF,SAAS,mBAAmB,CAAC,IAAmB;YAC9C,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,SAAS,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;YAC/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC3F,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,eAAe,CAAC,IAA8B;gBAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO;gBAEvC,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBAEtB,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAAE,OAAO;gBAEzE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}