eslint-plugin-node-security 4.5.0 → 4.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -1
- package/README.md +1 -0
- package/package.json +2 -2
- package/src/index.js +9 -1
- package/src/index.js.map +1 -1
- package/src/rules/no-ssrf/index.js +3 -1
- package/src/rules/no-ssrf/index.js.map +1 -1
- package/src/rules/no-unsafe-buffer-alloc/index.d.ts +47 -0
- package/src/rules/no-unsafe-buffer-alloc/index.js +100 -0
- package/src/rules/no-unsafe-buffer-alloc/index.js.map +1 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,4 +1,31 @@
|
|
|
1
|
-
##
|
|
1
|
+
## 4.6.0
|
|
2
|
+
|
|
3
|
+
### Minor Changes
|
|
4
|
+
|
|
5
|
+
- [#305](https://github.com/ofri-peretz/eslint/pull/305) [`8f1c9ef`](https://github.com/ofri-peretz/eslint/commit/8f1c9efbe99c592f8ed5ffca2d1ed8f53408af19) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - New rule `no-unsafe-buffer-alloc` (CWE-908, Use of Uninitialized Resource) —
|
|
6
|
+
closes a measured coverage gap against `security-node/detect-buffer-unsafe-allocation`
|
|
7
|
+
and `@microsoft/eslint-plugin-sdl/no-unsafe-alloc`.
|
|
8
|
+
|
|
9
|
+
It reports `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, both of which
|
|
10
|
+
return memory that was never zeroed, with a suggestion to swap in
|
|
11
|
+
`Buffer.alloc()`. Neither the existing `no-deprecated-buffer` (deprecated
|
|
12
|
+
`Buffer()` constructor, CWE-676) nor `no-buffer-overread` (read-side CWE-126)
|
|
13
|
+
flagged the allocation itself.
|
|
14
|
+
|
|
15
|
+
**The rule is unconditional and does no dataflow** — it does not try to prove
|
|
16
|
+
the buffer is fully overwritten before it is read, so a correct
|
|
17
|
+
`allocUnsafe` + `copy` pair is still reported. The one structural exemption is
|
|
18
|
+
`Buffer.allocUnsafe(n).fill(0)`, a parent-node check rather than variable
|
|
19
|
+
tracking. Because of that false-positive profile it ships as `warn` in
|
|
20
|
+
`recommended` rather than `error` (upstream `security-node` ships its
|
|
21
|
+
equivalent off by default).
|
|
22
|
+
|
|
23
|
+
### Patch Changes
|
|
24
|
+
|
|
25
|
+
- [#317](https://github.com/ofri-peretz/eslint/pull/317) [`5a8456b`](https://github.com/ofri-peretz/eslint/commit/5a8456b08ffa567be73a66393758ed17805e2fe4) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - `no-ssrf`: recognise `needle` as an HTTP client, so `needle.get(req.query.url)` reports. The verb-first `needle('get', url)` form is still not covered — the rule only inspects the first argument.
|
|
26
|
+
|
|
27
|
+
- Updated dependencies [[`09d2951`](https://github.com/ofri-peretz/eslint/commit/09d2951b3ac74efc9ba49b64e9089d66800b16cc)]:
|
|
28
|
+
- @interlace/eslint-devkit@1.4.4
|
|
2
29
|
|
|
3
30
|
## 4.5.0
|
|
4
31
|
|
|
@@ -249,6 +276,8 @@
|
|
|
249
276
|
- Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
|
|
250
277
|
- @interlace/eslint-devkit@1.4.1
|
|
251
278
|
|
|
279
|
+
## [4.1.0] - 2026-05-03
|
|
280
|
+
|
|
252
281
|
### Added
|
|
253
282
|
|
|
254
283
|
- New rule `no-deprecated-buffer` — flags use of the deprecated `Buffer()` constructor (Node.js security advisory; `Buffer.from`/`Buffer.alloc` should be used instead). Enabled in the `recommended` preset at `warn` to avoid breaking adopters with legacy `Buffer()` calls; will be promoted to `error` in the next major.
|
package/README.md
CHANGED
|
@@ -105,6 +105,7 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
|
|
|
105
105
|
| [no-static-iv](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-static-iv?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-329 | A02:2021 | | Disallow static or hardcoded initialization vectors (IVs) | 🟢 | | | | | |
|
|
106
106
|
| [no-timing-unsafe-compare](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-timing-unsafe-compare?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-208 | A02:2021 | | Disallow timing-unsafe comparison of secrets | 🟢 | | | | | |
|
|
107
107
|
| [no-toctou-vulnerability](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-toctou-vulnerability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-367 | A01:2021 | | Detects Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerabilities in file system operations. | 🟢 | | | | | |
|
|
108
|
+
| [no-unsafe-buffer-alloc](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-buffer-alloc?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-908 | A01:2021 | | Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory. | 🟢 | | | | 💡 | |
|
|
108
109
|
| [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-494 | | | Disallows dynamic require() calls with non-literal arguments that could lead to security vulnerabilities | 🟢 | | | | | |
|
|
109
110
|
| [no-weak-cipher-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 | | Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish, RC2, IDEA) | 🟢 | | | | | |
|
|
110
111
|
| [no-weak-hash-algorithm](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-weak-hash-algorithm?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 | | Disallow weak hash algorithms (MD5, MD4, SHA-1, RIPEMD) | 🟢 | | | | | |
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "eslint-plugin-node-security",
|
|
3
|
-
"version": "4.
|
|
3
|
+
"version": "4.6.0",
|
|
4
4
|
"description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -82,7 +82,7 @@
|
|
|
82
82
|
},
|
|
83
83
|
"dependencies": {
|
|
84
84
|
"tslib": "^2.3.0",
|
|
85
|
-
"@interlace/eslint-devkit": "^1.4.
|
|
85
|
+
"@interlace/eslint-devkit": "^1.4.4"
|
|
86
86
|
},
|
|
87
87
|
"devDependencies": {
|
|
88
88
|
"@typescript-eslint/parser": "^8.46.2",
|
package/src/index.js
CHANGED
|
@@ -12,6 +12,7 @@ const detect_non_literal_fs_filename_1 = require("./rules/detect-non-literal-fs-
|
|
|
12
12
|
const no_unsafe_dynamic_require_1 = require("./rules/no-unsafe-dynamic-require");
|
|
13
13
|
const no_buffer_overread_1 = require("./rules/no-buffer-overread");
|
|
14
14
|
const no_deprecated_buffer_1 = require("./rules/no-deprecated-buffer");
|
|
15
|
+
const no_unsafe_buffer_alloc_1 = require("./rules/no-unsafe-buffer-alloc");
|
|
15
16
|
const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
|
|
16
17
|
const no_zip_slip_1 = require("./rules/no-zip-slip");
|
|
17
18
|
const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
|
|
@@ -50,6 +51,7 @@ exports.rules = {
|
|
|
50
51
|
'no-unsafe-dynamic-require': no_unsafe_dynamic_require_1.noUnsafeDynamicRequire,
|
|
51
52
|
'no-buffer-overread': no_buffer_overread_1.noBufferOverread,
|
|
52
53
|
'no-deprecated-buffer': no_deprecated_buffer_1.noDeprecatedBuffer,
|
|
54
|
+
'no-unsafe-buffer-alloc': no_unsafe_buffer_alloc_1.noUnsafeBufferAlloc,
|
|
53
55
|
'no-toctou-vulnerability': no_toctou_vulnerability_1.noToctouVulnerability,
|
|
54
56
|
'no-zip-slip': no_zip_slip_1.noZipSlip,
|
|
55
57
|
'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
|
|
@@ -85,7 +87,7 @@ exports.rules = {
|
|
|
85
87
|
exports.plugin = {
|
|
86
88
|
meta: {
|
|
87
89
|
name: 'eslint-plugin-node-security',
|
|
88
|
-
version: '4.
|
|
90
|
+
version: '4.6.0',
|
|
89
91
|
},
|
|
90
92
|
rules: exports.rules,
|
|
91
93
|
};
|
|
@@ -105,6 +107,12 @@ const recommendedRules = {
|
|
|
105
107
|
// adopters who already use the preset and have legacy `Buffer()` calls.
|
|
106
108
|
// Promote to 'error' on the next major bump.
|
|
107
109
|
'node-security/no-deprecated-buffer': 'error',
|
|
110
|
+
// Added in 4.5.0. Unconditional flag on `Buffer.allocUnsafe()` — a real but
|
|
111
|
+
// legitimate performance API — so it ships as 'warn', not 'error'. The rule
|
|
112
|
+
// does no dataflow, so a correctly-overwritten buffer still reports.
|
|
113
|
+
// Upstream `security-node/detect-buffer-unsafe-allocation` ships this off by
|
|
114
|
+
// default; 'warn' is the middle ground.
|
|
115
|
+
'node-security/no-unsafe-buffer-alloc': 'warn',
|
|
108
116
|
'node-security/no-toctou-vulnerability': 'error',
|
|
109
117
|
'node-security/no-zip-slip': 'error',
|
|
110
118
|
'node-security/no-arbitrary-file-access': 'error',
|
package/src/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,0EAA0E;IAC1E,iEAAiE;IACjE,wCAAwC,EAAE,MAAM;IAEhD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,2EAAqE;AACrE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,wBAAwB,EAAE,4CAAmB;IAC7C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,6EAA6E;IAC7E,wCAAwC;IACxC,sCAAsC,EAAE,MAAM;IAC9C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,0EAA0E;IAC1E,iEAAiE;IACjE,wCAAwC,EAAE,MAAM;IAEhD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}
|
|
@@ -19,8 +19,10 @@ const HTTP_CLIENT_METHODS = new Set([
|
|
|
19
19
|
'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'request',
|
|
20
20
|
]);
|
|
21
21
|
// Object names that are HTTP client libraries
|
|
22
|
+
// `needle.get(url)` is covered here; the `needle('get', url)` verb-first form
|
|
23
|
+
// is not — the URL sits in argument 1, and this rule only reads argument 0.
|
|
22
24
|
const HTTP_CLIENT_OBJECTS = new Set([
|
|
23
|
-
'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici',
|
|
25
|
+
'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici', 'needle',
|
|
24
26
|
]);
|
|
25
27
|
// Function names that indicate URL validation
|
|
26
28
|
const VALIDATION_FUNCTION_NAMES = new Set([
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-ssrf/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4DAKkC;AAWlC,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAQ,wBAAwB;IACvC,KAAK,EAAU,MAAM;IACrB,WAAW,EAAI,aAAa;IAC5B,QAAQ,EAAO,SAAS;CACzB,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;CACtE,CAAC,CAAC;AAEH,8CAA8C;AAC9C,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;CAC7E,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACpE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa;CACnE,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACxC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAClC,MAAM,EAAE,OAAO,EAAE,OAAO;CACzB,CAAC;AAEF;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvE,0EAA0E;AAC1E,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAExD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC1C,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,8BAAc,CAAC,UAAU;YAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzC,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAEhC,KAAK,8BAAc,CAAC,eAAe;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,wEAAwE;QACxE,KAAK,8BAAc,CAAC,cAAc,CAAC;QACnC,KAAK,8BAAc,CAAC,aAAa;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElD,8BAA8B;QAC9B,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAqB,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5F,sEAAsE;QACtE,sEAAsE;QACtE,KAAK,8BAAc,CAAC,gBAAgB;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAsB,CAAC;gBAC9C,IAAI,gBAAgB,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzC,MAAM,GAAG,GACP,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC7C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;oBACnB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;wBAC5C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;wBAC5B,CAAC,CAAC,EAAE,CAAC;gBACX,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;QAEL;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAmB;IACjD,oDAAoD;IACpD,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;QAC9C,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EACvD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IACE,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;QAC7C,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACnD,CACE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;YAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChF,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACtD,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CACnF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE5F,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAI,IAA2C,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAK,KAAiC,EAAE,CAAC;YACvF,IAAI,sBAAsB,CAAC,KAAsB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACvD,IAAI,sBAAsB,CAAC,IAAqB,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAA6B;IACxD,uCAAuC;IACvC,IAAI,OAAO,GAA+B,IAAmD,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAA+B,OAAsD,CAAC,MAAM,CAAC;QACzG,IAAI,CAAC,MAAM;YAAE,MAAM;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAA6B,CAAC,CAAC;YAExD,4DAA4D;YAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAEY,QAAA,MAAM,GAAG,IAAA,0BAAU,EAA0B;IACxD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,GAAG,EAAE,4GAA4G;YACjH,WAAW,EACT,8JAA8J;YAChK,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,GAAG;SACV;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,SAAS;gBACd,WAAW,EACT,yLAAyL;gBAC3L,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kHAAkH;gBACvH,iBAAiB,EACf,wGAAwG;aAC3G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EAAE,YAAY,GAAG,IAAI,EAAE,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,UAAU,GACd,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO;YACL,cAAc,CAAC,IAA6B;gBAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;gBAEvB,gDAAgD;gBAChD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC9C,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,oDAAoD;gBACpD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACvD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClD,CAAC;oBACD,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAExB,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,uEAAuE;gBACvE,mEAAmE;gBAEnE,oDAAoD;gBACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBAED,mEAAmE;gBACnE,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,CAAC,mBAAmB,CAAC,MAAuB,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;iBAC/B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Copyright (c) 2025 Ofri Peretz
|
|
3
|
+
* Licensed under the MIT License. Use of this source code is governed by the
|
|
4
|
+
* MIT license that can be found in the LICENSE file.
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* ESLint Rule: no-unsafe-buffer-alloc
|
|
8
|
+
*
|
|
9
|
+
* Detects `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which hand
|
|
10
|
+
* back a buffer over memory that was never zeroed. Until every byte is
|
|
11
|
+
* overwritten the buffer contains whatever the allocator last held there —
|
|
12
|
+
* request bodies, session tokens, private keys. Reading or transmitting it
|
|
13
|
+
* before it is fully written discloses that memory (CVE-2018-7166 is the
|
|
14
|
+
* canonical instance of this class in Node itself).
|
|
15
|
+
*
|
|
16
|
+
* CWE-908: Use of Uninitialized Resource
|
|
17
|
+
* OWASP A01:2021 – Broken Access Control
|
|
18
|
+
*
|
|
19
|
+
* ## Detection method: structural-api
|
|
20
|
+
*
|
|
21
|
+
* Unconditional by design. The rule fires on the AST shape
|
|
22
|
+
* `<Buffer>.allocUnsafe(...)` / `<Buffer>.allocUnsafeSlow(...)` and performs
|
|
23
|
+
* **no dataflow or taint analysis** — it does not attempt to prove whether the
|
|
24
|
+
* buffer is fully overwritten before it is read. Rename every variable in the
|
|
25
|
+
* file and it reports identically.
|
|
26
|
+
*
|
|
27
|
+
* The single structural exemption is a same-expression `.fill()`, e.g.
|
|
28
|
+
* `Buffer.allocUnsafe(n).fill(0)`, which zeroes the allocation on the spot and
|
|
29
|
+
* is therefore equivalent to `Buffer.alloc(n)`. That is a parent-node check,
|
|
30
|
+
* not variable tracking.
|
|
31
|
+
*
|
|
32
|
+
* Consequence: a correct `allocUnsafe` immediately overwritten through a
|
|
33
|
+
* variable (`const b = Buffer.allocUnsafe(n); src.copy(b);`) is still reported.
|
|
34
|
+
* That is the documented false-positive profile and the reason the rule ships
|
|
35
|
+
* as `warn` rather than `error` in `recommended`. The complementary CWE-126
|
|
36
|
+
* read-side analysis lives in `no-buffer-overread`.
|
|
37
|
+
*
|
|
38
|
+
* @see https://cwe.mitre.org/data/definitions/908.html
|
|
39
|
+
* @see https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize
|
|
40
|
+
* @see https://nvd.nist.gov/vuln/detail/CVE-2018-7166
|
|
41
|
+
*/
|
|
42
|
+
import type { TSESLint } from '@interlace/eslint-devkit';
|
|
43
|
+
type MessageIds = 'unsafeAlloc' | 'unsafeAllocSlow' | 'useSafeAlloc';
|
|
44
|
+
export declare const noUnsafeBufferAlloc: TSESLint.RuleModule<MessageIds, [], unknown, TSESLint.RuleListener> & {
|
|
45
|
+
name: string;
|
|
46
|
+
};
|
|
47
|
+
export {};
|
|
@@ -0,0 +1,100 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Copyright (c) 2025 Ofri Peretz
|
|
4
|
+
* Licensed under the MIT License. Use of this source code is governed by the
|
|
5
|
+
* MIT license that can be found in the LICENSE file.
|
|
6
|
+
*/
|
|
7
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
+
exports.noUnsafeBufferAlloc = void 0;
|
|
9
|
+
const eslint_devkit_1 = require("@interlace/eslint-devkit");
|
|
10
|
+
/** The two uninitialized-memory allocators on `Buffer`. */
|
|
11
|
+
const UNSAFE_ALLOCATORS = new Set(['allocUnsafe', 'allocUnsafeSlow']);
|
|
12
|
+
exports.noUnsafeBufferAlloc = (0, eslint_devkit_1.createRule)({
|
|
13
|
+
name: 'no-unsafe-buffer-alloc',
|
|
14
|
+
meta: {
|
|
15
|
+
type: 'problem',
|
|
16
|
+
hasSuggestions: true,
|
|
17
|
+
docs: {
|
|
18
|
+
url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-buffer-alloc.md',
|
|
19
|
+
description: 'Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory',
|
|
20
|
+
cwe: 'CWE-908',
|
|
21
|
+
cweJustification: 'CWE-908 (Use of Uninitialized Resource) — allocUnsafe returns a view over non-zeroed heap memory; any byte not overwritten before the buffer is read or transmitted discloses prior process memory.',
|
|
22
|
+
cvss: 7.5,
|
|
23
|
+
confidence: 'high',
|
|
24
|
+
},
|
|
25
|
+
messages: {
|
|
26
|
+
unsafeAlloc: (0, eslint_devkit_1.formatLLMMessage)({
|
|
27
|
+
icon: eslint_devkit_1.MessageIcons.SECURITY,
|
|
28
|
+
issueName: 'Uninitialized Buffer Allocation',
|
|
29
|
+
cwe: 'CWE-908',
|
|
30
|
+
cvss: 7.5,
|
|
31
|
+
description: '`Buffer.allocUnsafe(size)` returns memory that has not been zeroed. Every byte not overwritten before the buffer is read or sent leaks whatever the allocator previously stored there.',
|
|
32
|
+
severity: 'HIGH',
|
|
33
|
+
fix: 'Use `Buffer.alloc(size)` (zero-filled), or keep `allocUnsafe` only where the very next statement overwrites the whole buffer — `Buffer.allocUnsafe(size).fill(0)` is accepted by this rule.',
|
|
34
|
+
documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize',
|
|
35
|
+
}),
|
|
36
|
+
unsafeAllocSlow: (0, eslint_devkit_1.formatLLMMessage)({
|
|
37
|
+
icon: eslint_devkit_1.MessageIcons.SECURITY,
|
|
38
|
+
issueName: 'Uninitialized Buffer Allocation (allocUnsafeSlow)',
|
|
39
|
+
cwe: 'CWE-908',
|
|
40
|
+
cvss: 7.5,
|
|
41
|
+
description: '`Buffer.allocUnsafeSlow(size)` allocates outside the shared pool but is equally uninitialized — the returned bytes are whatever was last in that memory.',
|
|
42
|
+
severity: 'HIGH',
|
|
43
|
+
fix: 'Use `Buffer.alloc(size)`, or append `.fill(0)` to zero the allocation at the call site.',
|
|
44
|
+
documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafeslowsize',
|
|
45
|
+
}),
|
|
46
|
+
useSafeAlloc: 'Replace with `Buffer.alloc()` (zero-filled).',
|
|
47
|
+
},
|
|
48
|
+
schema: [],
|
|
49
|
+
},
|
|
50
|
+
defaultOptions: [],
|
|
51
|
+
create(context) {
|
|
52
|
+
/**
|
|
53
|
+
* True when the call's result is immediately zeroed in the same
|
|
54
|
+
* expression: `Buffer.allocUnsafe(n).fill(0)`. Parent-node shape only.
|
|
55
|
+
*/
|
|
56
|
+
function isFilledInPlace(node) {
|
|
57
|
+
const parent = node.parent;
|
|
58
|
+
if (parent?.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
|
|
59
|
+
parent.object !== node ||
|
|
60
|
+
parent.computed ||
|
|
61
|
+
parent.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
|
|
62
|
+
parent.property.name !== 'fill') {
|
|
63
|
+
return false;
|
|
64
|
+
}
|
|
65
|
+
// `.fill` must actually be invoked — `f(buf.fill)` passes the method
|
|
66
|
+
// around, it does not zero anything.
|
|
67
|
+
const grandparent = parent.parent;
|
|
68
|
+
return (grandparent?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
|
|
69
|
+
grandparent.callee === parent);
|
|
70
|
+
}
|
|
71
|
+
return {
|
|
72
|
+
CallExpression(node) {
|
|
73
|
+
const callee = node.callee;
|
|
74
|
+
if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
|
|
75
|
+
callee.computed ||
|
|
76
|
+
callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
|
|
77
|
+
callee.object.name !== 'Buffer' ||
|
|
78
|
+
callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
|
|
79
|
+
!UNSAFE_ALLOCATORS.has(callee.property.name)) {
|
|
80
|
+
return;
|
|
81
|
+
}
|
|
82
|
+
if (isFilledInPlace(node))
|
|
83
|
+
return;
|
|
84
|
+
context.report({
|
|
85
|
+
node,
|
|
86
|
+
messageId: callee.property.name === 'allocUnsafe'
|
|
87
|
+
? 'unsafeAlloc'
|
|
88
|
+
: 'unsafeAllocSlow',
|
|
89
|
+
suggest: [
|
|
90
|
+
{
|
|
91
|
+
messageId: 'useSafeAlloc',
|
|
92
|
+
fix: (fixer) => fixer.replaceText(callee.property, 'alloc'),
|
|
93
|
+
},
|
|
94
|
+
],
|
|
95
|
+
});
|
|
96
|
+
},
|
|
97
|
+
};
|
|
98
|
+
},
|
|
99
|
+
});
|
|
100
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/no-unsafe-buffer-alloc/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAwCH,4DAKkC;AAIlC,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEzD,QAAA,mBAAmB,GAAG,IAAA,0BAAU,EAAiB;IAC5D,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE;YACJ,GAAG,EAAE,2HAA2H;YAChI,WAAW,EACT,mGAAmG;YACrG,GAAG,EAAE,SAAS;YACd,gBAAgB,EACd,qMAAqM;YACvM,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,MAAM;SACnB;QACD,QAAQ,EAAE;YACR,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,iCAAiC;gBAC5C,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,wLAAwL;gBAC1L,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,6LAA6L;gBAClM,iBAAiB,EACf,wEAAwE;aAC3E,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mDAAmD;gBAC9D,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EACT,0JAA0J;gBAC5J,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,yFAAyF;gBAC9F,iBAAiB,EACf,4EAA4E;aAC/E,CAAC;YACF,YAAY,EAAE,8CAA8C;SAC7D;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ;;;WAGG;QACH,SAAS,eAAe,CAAC,IAA6B;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IACE,MAAM,EAAE,IAAI,KAAK,8BAAc,CAAC,gBAAgB;gBAChD,MAAM,CAAC,MAAM,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ;gBACf,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,EAC/B,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAClC,OAAO,CACL,WAAW,EAAE,IAAI,KAAK,8BAAc,CAAC,cAAc;gBACnD,WAAW,CAAC,MAAM,KAAK,MAAM,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,cAAc,CAAC,IAAI;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IACE,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,QAAQ;oBACf,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAClD,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAElC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EACP,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa;wBACpC,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,iBAAiB;oBACvB,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,cAAc;4BACzB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE,CACjC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;yBAC9C;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
|