eslint-plugin-node-security 4.5.0 → 4.7.0

package/src/rules/detect-eval-with-expression/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEvalWithExpression = exports.generateRefactoringSteps = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -35,7 +30,6 @@ const EVAL_PATTERNS = [
         safeAlternative: 'Template literals or template engine',
         example: {
             bad: 'eval(\'Hello \' + userName + \'!\')',
-            // oxlint-disable-next-line no-template-curly-in-string
             good: 'const template = `Hello ${userName}!`;'
         },
         effort: '3 minutes'
@@ -51,10 +45,6 @@ const EVAL_PATTERNS = [
         effort: '8 minutes'
     }
 ];
-/**
- * Generate refactoring steps based on pattern.
- * Module-scope so it is directly unit-testable (Layer-2).
- */
 const generateRefactoringSteps = (pattern) => {
     if (!pattern) {
         return [
@@ -80,10 +70,8 @@ const generateRefactoringSteps = (pattern) => {
                 '   3. Validate inputs are numbers',
                 '   4. Consider using a math expression parser library'
             ].join('\n');
-        // oxlint-disable-next-line no-template-curly-in-string
         case 'template':
             return [
-                // oxlint-disable-next-line no-template-curly-in-string
                 '   1. Use template literals: `Hello ${name}`',
                 '   2. Sanitize variables before interpolation',
                 '   3. Use a template engine like Handlebars if complex',
@@ -118,7 +106,6 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
             confidence: 'high',
         },
         messages: {
-            // 🎯 Token optimization: 38% reduction (47→29 tokens) - compact format saves LLM processing
             evalWithExpression: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.SECURITY,
                 issueName: 'eval() with dynamic code',
@@ -151,9 +138,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
                 issueName: 'Unsafe eval() for string interpolation',
                 cwe: 'CWE-95',
                 description: 'Use template literals instead of eval() for string interpolation',
-                // oxlint-disable-next-line no-template-curly-in-string
                 severity: 'HIGH',
-                // oxlint-disable-next-line no-template-curly-in-string
                 fix: 'Replace eval() with template literals: `Hello ${name}`',
                 documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
             }),
@@ -239,25 +224,14 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
     create(context) {
         const options = context.options[0] || {};
         const { allowLiteralStrings = false, additionalEvalFunctions = [], strategy = 'auto' } = options;
-        /**
-         * All functions that can execute arbitrary code
-         * NOTE: setTimeout/setInterval are NOT eval-like - they don't execute code strings
-         */
         const evalFunctions = new Set([
             'eval',
             'Function',
             ...additionalEvalFunctions
         ]);
-        /**
-         * Check if a node is a literal string (safe)
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isLiteralString = (node) => {
             return node.type === 'Literal' && typeof node.value === 'string';
         };
-        /**
-         * Select message ID based on strategy
-         */
         const selectStrategyMessage = (pattern) => {
             switch (strategy) {
                 case 'remove':
@@ -268,7 +242,6 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
                     return 'strategyValidate';
                 case 'auto':
                 default:
-                    // Auto mode: choose based on pattern confidence
                     if (pattern && pattern.category === 'json') {
                         return 'useJsonParse';
                     }
@@ -278,12 +251,9 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
                     if (pattern && pattern.category === 'template') {
                         return 'useTemplateLiteral';
                     }
-                    return 'strategyRefactor'; // Default to refactor for unknown patterns
+                    return 'strategyRefactor';
             }
         };
-        /**
-         * Detect the pattern category from the expression
-         */
         const detectPattern = (expression) => {
             for (const pattern of EVAL_PATTERNS) {
                 if (new RegExp(pattern.pattern, 'i').test(expression)) {
@@ -292,31 +262,21 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
             }
             return null;
         };
-        /**
-         * Extract expression text for pattern analysis
-         */
         const extractExpression = (node) => {
             const sourceCode = context.sourceCode;
-            // Try to get the argument text
             if (node.arguments.length > 0) {
                 return sourceCode.getText(node.arguments[0]);
             }
             return 'dynamic expression';
         };
-        /**
-         * Check call expressions for dangerous eval usage
-         */
         const checkCallExpression = (node) => {
-            // Check if it's a call to an eval-like function
             if (node.callee.type === 'Identifier' &&
                 evalFunctions.has(node.callee.name)) {
-                // Skip if it's a literal string and literals are allowed
                 if (allowLiteralStrings &&
                     node.arguments.length > 0 &&
                     isLiteralString(node.arguments[0])) {
                     return;
                 }
-                // Skip if it's a direct string literal (safe)
                 if (node.arguments.length > 0 &&
                     node.callee.name === 'eval' &&
                     isLiteralString(node.arguments[0])) {
@@ -343,12 +303,11 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
                                 safeAlternative: pattern.safeAlternative,
                                 alternative: pattern.safeAlternative
                             },
-                            fix: () => null // Complex refactoring, cannot auto-fix safely
+                            fix: () => null
                         }
                     ] : undefined
                 });
             }
-            // Also check for Function constructor usage
             if (node.callee.type === 'NewExpression' &&
                 node.callee.callee.type === 'Identifier' &&
                 node.callee.callee.name === 'Function') {
@@ -373,11 +332,7 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
                 });
             }
         };
-        /**
-         * Check NewExpression for Function constructor usage
-         */
         const checkNewExpression = (node) => {
-            // Check for new Function() usage
             if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
                 const sourceCode = context.sourceCode;
                 const expression = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
@@ -407,4 +362,3 @@ exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/detect-non-literal-fs-filename/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.generateRefactoringSteps = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -54,18 +49,9 @@ const FS_OPERATIONS = [
         effort: '15-20 minutes'
     }
 ];
-/**
- * Check if path has dangerous patterns like ../ or ..\
- * Module-scope so it is directly unit-testable (Layer-2).
- */
 const hasTraversalPatterns = (pathStr) => {
     return /\.\.[/\\]/.test(pathStr) || /^\.\.[/\\]/.test(pathStr);
 };
-/**
- * Generate refactoring steps based on the operation.
- * Module-scope so the default arm (methods without a dedicated entry) is
- * directly unit-testable (Layer-2).
- */
 const generateRefactoringSteps = (operation) => {
     switch (operation.method) {
         case 'readFile':
@@ -104,11 +90,6 @@ const generateRefactoringSteps = (operation) => {
     }
 };
 exports.generateRefactoringSteps = generateRefactoringSteps;
-/**
- * Determine risk level based on the operation and path.
- * Module-scope so the non-dangerous fallback (no FS_OPERATIONS entry sets
- * dangerous: false today) is directly unit-testable (Layer-2).
- */
 const determineRiskLevel = (operation, pathStr) => {
     if (hasTraversalPatterns(pathStr)) {
         return 'CRITICAL';
@@ -130,7 +111,6 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             confidence: 'medium',
         },
         messages: {
-            // 🎯 Token optimization: 39% reduction (49→30 tokens) - template variables still work
             fsPathTraversal: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: '🔑',
                 issueName: 'Path traversal',
@@ -216,9 +196,6 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
     create(context) {
         const options = context.options[0] || {};
         const { allowLiterals = false, additionalMethods = [] } = options;
-        /**
-         * File system methods that can be dangerous with user input
-         */
         const dangerousMethods = new Set([
             'readFile', 'readFileSync',
             'writeFile', 'writeFileSync',
@@ -233,48 +210,29 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             'createReadStream', 'createWriteStream',
             ...additionalMethods
         ]);
-        /**
-         * Check if a node is a literal string (safe)
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isLiteralString = (node) => {
             return node.type === 'Literal' && typeof node.value === 'string';
         };
-        /**
-         * Extract path argument from fs call.
-         * `method` comes from checkFsCall, which already resolved the callee
-         * shape — re-deriving it here would hide an unreachable defensive branch.
-         */
         const extractPathArgument = (node, method) => {
             const operation = FS_OPERATIONS.find(op => op.method === method) || null;
-            // First argument is usually the path
             const pathNode = node.arguments.length > 0 ? node.arguments[0] : null;
             const sourceCode = context.sourceCode;
             const path = pathNode ? sourceCode.getText(pathNode) : '';
             return { path, pathNode, operation };
         };
-        /**
-         * Determine if the path argument is potentially dangerous
-         */
         const isDangerousPath = (pathNode, pathStr) => {
-            // Allow literals if configured
             if (allowLiterals && pathNode && isLiteralString(pathNode)) {
                 return false;
             }
-            // Check for obvious traversal patterns in literals
             if (pathNode && isLiteralString(pathNode) && hasTraversalPatterns(pathStr)) {
                 return true;
             }
-            // SAFE: path.join(__dirname, 'literal', 'path') with all literal args
             if (pathNode && isSafePathConstruction(pathNode)) {
                 return false;
             }
-            // SAFE: Path variable inside validated if-block with startsWith check
             if (pathNode && hasPathValidation(pathNode)) {
                 return false;
             }
-            // SAFE: path.join("./base", dynamicVar) where dynamicVar has been validated
-            // Extract dynamic identifiers from path.join/resolve calls and check their validation
             if (pathNode && pathNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                 const callee = pathNode.callee;
                 if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
@@ -282,23 +240,14 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                     callee.object.name === 'path' &&
                     callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     ['join', 'resolve'].includes(callee.property.name)) {
-                    // Find any dynamic (non-literal) identifier args and check if they're validated
                     const dynamicArgs = pathNode.arguments.filter((arg) => arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name !== '__dirname');
                     if (dynamicArgs.length > 0 && dynamicArgs.every((arg) => hasPathValidation(arg))) {
                         return false;
                     }
                 }
             }
-            // Any non-literal is dangerous
             return !pathNode || !isLiteralString(pathNode);
         };
-        /**
-         * Check if path is constructed safely using path.join/__dirname with literal args
-         *
-         * Safe patterns:
-         * - path.join(__dirname, 'data', 'file.json')
-         * - path.resolve(__dirname, 'uploads')
-         */
         const isSafePathConstruction = (pathNode) => {
             if (pathNode.type !== eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                 return false;
@@ -318,44 +267,29 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             if (args.length === 0) {
                 return false;
             }
-            // First arg should be __dirname or a literal
             const firstArg = args[0];
             const isFirstArgSafe = (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && firstArg.name === '__dirname') ||
                 (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string');
             if (!isFirstArgSafe) {
                 return false;
             }
-            // All remaining args should be literals
             for (let i = 1; i < args.length; i++) {
                 const arg = args[i];
                 if (arg.type !== eslint_devkit_1.AST_NODE_TYPES.Literal || typeof arg.value !== 'string') {
                     return false;
                 }
-                // Also check for traversal patterns in literals
                 if (hasTraversalPatterns(String(arg.value))) {
                     return false;
                 }
             }
             return true;
         };
-        /**
-         * Check if the path variable has been validated with startsWith()
-         *
-         * Safe patterns:
-         * 1. Inside if-block: if (safePath.startsWith(SAFE_DIR)) { fs.readFileSync(safePath); }
-         * 2. After guard clause: if (!safePath.startsWith(SAFE_DIR)) { throw }; fs.readFileSync(safePath);
-         */
         const hasPathValidation = (pathNode) => {
             if (pathNode.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                 return false;
             }
             const varName = pathNode.name;
-            // AST-based validation detection (faster than getText + regex)
             const isValidationCall = (testNode) => {
-                // Handle negation: !path.startsWith(...). The negation flag was
-                // tracked here but never read afterwards (CodeQL:
-                // `js/useless-assignment-to-local`); current callers only need to
-                // know whether the call matches a validation idiom.
                 if (testNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
                     testNode.operator === '!' &&
                     testNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
@@ -364,7 +298,6 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                 if (testNode.type !== eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                     return false;
                 }
-                // Pattern 1: varName.startsWith(...) or varName.includes(...)
                 if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     testNode.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     testNode.callee.object.name === varName &&
@@ -373,22 +306,18 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                         testNode.callee.property.name === 'includes')) {
                     return true;
                 }
-                // Pattern 2: ALLOWED_FILES.includes(varName) - allowlist validation
                 if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     testNode.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     testNode.callee.property.name === 'includes') {
-                    // Check if varName is in the arguments
                     for (const arg of testNode.arguments) {
                         if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name === varName) {
                             return true;
                         }
                     }
                 }
-                // Pattern 3: /regex/.test(varName) - regex validation
                 if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     testNode.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     testNode.callee.property.name === 'test') {
-                    // Check if varName is in the arguments
                     for (const arg of testNode.arguments) {
                         if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name === varName) {
                             return true;
@@ -405,17 +334,14 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                 return consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement ||
                     consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement;
             };
-            // Walk up to find enclosing IfStatement or BlockStatement
             let current = pathNode.parent;
             let foundFunctionBody = false;
             while (current && !foundFunctionBody) {
-                // Check 1: Inside an if-block with validation
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
                     if (isValidationCall(current.test)) {
                         return true;
                     }
                 }
-                // Check 2: In a function body, look for preceding sibling if-statements with guard clause
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement && current.parent && (current.parent.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
                     current.parent.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
                     current.parent.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression)) {
@@ -430,7 +356,6 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                         }
                         return false;
                     });
-                    // Look at preceding statements for validation patterns with early exit
                     for (let i = 0; i < nodeIndex; i++) {
                         const stmt = blockBody[i];
                         if (stmt.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement &&
@@ -444,11 +369,7 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             }
             return false;
         };
-        /**
-         * Check fs method calls for path traversal vulnerabilities
-         */
         const checkFsCall = (node) => {
-            // Check if it's an fs method call
             if (node.callee.type !== 'MemberExpression' ||
                 node.callee.object.type !== 'Identifier' ||
                 node.callee.object.name !== 'fs' ||
@@ -456,13 +377,11 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
                 return;
             }
             const methodName = node.callee.property.name;
-            // Skip if not a dangerous method
             if (!dangerousMethods.has(methodName)) {
                 return;
             }
             const { path, pathNode, operation } = extractPathArgument(node, methodName);
             const method = methodName;
-            // Check if the path argument is dangerous
             if (!isDangerousPath(pathNode, path)) {
                 return;
             }
@@ -510,4 +429,3 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/detect-suspicious-dependencies/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectSuspiciousDependencies = void 0;
-/**
- * @fileoverview Detect potential typosquatting in dependencies
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/506.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
     name: 'detect-suspicious-dependencies',
@@ -38,7 +28,6 @@ exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
     defaultOptions: [],
     create(context) {
         const popularPackages = ['react', 'lodash', 'express', 'axios', 'webpack'];
-        // oxlint-disable-next-line consistent-function-scoping
         function levenshtein(a, b) {
             const matrix = [];
             for (let i = 0; i <= b.length; i++) {
@@ -78,4 +67,3 @@ exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/lock-file/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lockFile = void 0;
-/**
- * @fileoverview Ensure package lock file exists
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/829.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.lockFile = (0, eslint_devkit_1.createRule)({
     name: 'lock-file',
@@ -50,7 +40,6 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
     create(context) {
         const fs = require('node:fs');
         const path = require('node:path');
-        // Check once per file
         let checked = false;
         const options = context.options[0] || {};
         const userPackageManager = options.packageManager;
@@ -59,10 +48,6 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
             yarn: 'yarn.lock',
             pnpm: 'pnpm-lock.yaml',
         };
-        // When no packageManager is configured, accept ANY of the three common
-        // lock files. Otherwise look only for the configured one. This avoids
-        // firing on every file in a pnpm/yarn monorepo just because the rule
-        // defaulted to looking for package-lock.json.
         const targetLockFiles = userPackageManager
             ? [lockFiles[userPackageManager]]
             : Object.values(lockFiles);
@@ -75,10 +60,8 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
                 if (checked)
                     return;
                 checked = true;
-                // Find project root (simplified)
                 let dir = path.dirname(context.filename);
                 let found = false;
-                // Search up to 10 levels for any acceptable lock file
                 for (let i = 0; i < 10; i++) {
                     for (const lf of targetLockFiles) {
                         if (fs.existsSync(path.join(dir, lf))) {
@@ -107,4 +90,3 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-arbitrary-file-access/index.js

@@ -1,21 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noArbitraryFileAccess = void 0;
-/**
- * @fileoverview Prevent file access from user input
- *
- * False Positive Reduction:
- * This rule detects safe patterns including:
- * - path.basename() sanitization
- * - path.join() with validated base directories
- * - startsWith() validation guards
- * - Early-return throw patterns
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
     name: 'no-arbitrary-file-access',
@@ -49,20 +34,14 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
         const fsReadMethods = ['readFile', 'readFileSync', 'readdir', 'readdirSync', 'stat', 'statSync'];
         const fsWriteMethods = ['writeFile', 'writeFileSync', 'appendFile', 'appendFileSync'];
         const userInputSources = new Set(['req', 'request', 'params', 'query', 'body']);
-        // Track variables that have been sanitized with path.basename()
         const sanitizedVariables = new Set();
-        // Track variables that have been validated with startsWith() guards
         const validatedVariables = new Set();
-        /**
-         * Check if a variable is assigned from path.basename() or path.join() with basename
-         */
         function checkVariableDeclaration(node) {
             if (node.id.type !== 'Identifier' || !node.init) {
                 return;
             }
             const varName = node.id.name;
             const init = node.init;
-            // Check for path.basename() assignment
             if (init.type === 'CallExpression' &&
                 init.callee.type === 'MemberExpression' &&
                 init.callee.object.type === 'Identifier' &&
@@ -71,16 +50,13 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
                 init.callee.property.name === 'basename') {
                 sanitizedVariables.add(varName);
             }
-            // Check for path.join() with a sanitized variable or literal base
             if (init.type === 'CallExpression' &&
                 init.callee.type === 'MemberExpression' &&
                 init.callee.object.type === 'Identifier' &&
                 init.callee.object.name === 'path' &&
                 init.callee.property.type === 'Identifier' &&
                 init.callee.property.name === 'join') {
-                // Check if any argument is a sanitized variable
                 const hasSanitizedArg = init.arguments.some((arg) => arg.type === 'Identifier' && sanitizedVariables.has(arg.name));
-                // Check if first arg is a safe base (literal or known safe variable)
                 const firstArg = init.arguments[0];
                 const hasSafeBase = firstArg && (firstArg.type === 'Literal' ||
                     (firstArg.type === 'Identifier' && /^(SAFE|BASE|ROOT|UPLOAD|PUBLIC)/i.test(firstArg.name)));
@@ -89,32 +65,19 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
                 }
             }
         }
-        /**
-         * Check if there's a startsWith() guard validation for this variable
-         * Looks for patterns like:
-         * if (!path.startsWith(baseDir)) { throw ... }
-         * if (!path.startsWith(baseDir)) { return ... }
-         */
         function hasStartsWithGuard(node, varName) {
-            // Already validated
             if (validatedVariables.has(varName)) {
                 return true;
             }
-            // Walk up to find the containing block or function
             let current = node.parent;
             while (current) {
-                // If we've reached a function body or block, search its statements
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
                     const statements = current.body;
-                    // Look for IF statements in this block that validate our variable
                     for (const stmt of statements) {
                         if (stmt.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
                             const testText = sourceCode.getText(stmt.test).toLowerCase();
-                            // Check for startsWith() validation pattern with our variable
                             if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
-                                // Check if this is a guard clause (negated condition with throw/return)
                                 const consequent = stmt.consequent;
-                                // Handle block statement: if (...) { throw/return; }
                                 if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement && consequent.body.length > 0) {
                                     const firstStmt = consequent.body[0];
                                     if (firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
@@ -122,7 +85,6 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
                                         return true;
                                     }
                                 }
-                                // Handle direct statement: if (...) throw/return;
                                 if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
                                     validatedVariables.add(varName);
                                     return true;
@@ -131,7 +93,6 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Also check if current IS an if statement (when node is inside the consequent)
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
                     const testText = sourceCode.getText(current.test).toLowerCase();
                     if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
@@ -143,52 +104,40 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
             }
             return false;
         }
-        /**
-         * Check if a variable comes from a sanitized/validated source
-         */
         function isVariableSafe(varName, node) {
-            // Already tracked as sanitized
             if (sanitizedVariables.has(varName)) {
                 return true;
             }
-            // Has startsWith guard validation
             if (hasStartsWithGuard(node, varName)) {
                 return true;
             }
-            // Check naming conventions that suggest safety
             if (/^(safe|sanitized|validated|clean)/i.test(varName)) {
                 return true;
             }
             return false;
         }
         return {
-            // Track variable declarations for sanitization patterns
             VariableDeclarator(node) {
                 checkVariableDeclaration(node);
             },
             CallExpression(node) {
-                // Detect fs.* with user input
                 if (node.callee.type === 'MemberExpression' &&
                     node.callee.object.type === 'Identifier' &&
                     node.callee.object.name === 'fs' &&
                     node.callee.property.type === 'Identifier' &&
                     [...fsReadMethods, ...fsWriteMethods].includes(node.callee.property.name)) {
                     const pathArg = node.arguments[0];
-                    // Skip if path is a literal (safe)
                     if (pathArg && pathArg.type === 'Literal') {
                         return;
                     }
-                    // Check if path is a variable
                     if (pathArg && pathArg.type === 'Identifier') {
                         const varName = pathArg.name;
-                        // Skip if variable is sanitized or validated
                         if (isVariableSafe(varName, node)) {
                             return;
                         }
                         report(node);
                         return;
                     }
-                    // Flag if path is from a member expression (user input sources)
                     if (pathArg?.type === 'MemberExpression' &&
                         pathArg.object.type === 'Identifier') {
                         const objName = pathArg.object.name.toLowerCase();
@@ -201,4 +150,3 @@ exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map