eslint-plugin-node-security 4.5.0 → 4.7.0

package/src/rules/no-buffer-overread/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noBufferOverread = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -186,22 +181,15 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
         const { bufferMethods = ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], boundsCheckFunctions = ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], bufferTypes = ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
         const sourceCode = context.sourceCode;
         const filename = context.filename;
-        // Create safety checker for false positive detection
         const safetyChecker = (0, eslint_devkit_1.createSafetyChecker)({
             trustedSanitizers,
             trustedAnnotations,
             trustedOrmPatterns: [],
             strictMode,
         });
-        // Pre-compute Sets for O(1) lookups (performance optimization)
         const bufferTypesSet = new Set(bufferTypes.map(t => t.toLowerCase()));
         const userControlledKeywords = new Set(['req', 'request', 'query', 'params', 'input', 'user', 'offset', 'index', 'body']);
-        // Track buffer variables
         const bufferVars = new Set();
-        /**
-         * Check if variable is a buffer type
-         * Uses Set-based lookup for O(1) performance
-         */
         const isBufferType = (varName) => {
             if (bufferVars.has(varName))
                 return true;
@@ -210,26 +198,11 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                 if (lowerName.includes(type))
                     return true;
             }
-            // Conventional Buffer parameter names. `buf` and `bytes` are strong
-            // signals for Node Buffer parameters (the original FN target). `b`
-            // and `chunk` are intentionally excluded — single-char names and
-            // stream-chunk array variables produce too many FPs in real code.
             if (lowerName === 'buf' || lowerName === 'bytes')
                 return true;
             return false;
         };
-        /**
-         * Check if index is user-controlled
-         * Uses Set-based keyword matching for O(1) lookups
-         */
         const isUserControlledIndex = (indexNode) => {
-            // Direct MemberExpression: `req.query.length`, `req.body.size`,
-            // `event.queryStringParameters.limit`, etc. — walk the chain to
-            // check if the root identifier is a known taint source. Closes the
-            // audit FN where `buf.slice(0, req.query.length)` was bypassing
-            // detection because the arg was a MemberExpression, not an
-            // Identifier. See benchmarks/AUDIT_PATTERNS.md §3.6 ("taint-source
-            // breadth").
             if (indexNode.type === 'MemberExpression') {
                 let walker = indexNode;
                 while (walker.type === 'MemberExpression') {
@@ -237,11 +210,9 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                 }
                 if (walker.type === 'Identifier') {
                     const root = walker.name.toLowerCase();
-                    // Express / Lambda / Koa / Hono taint-source roots.
                     if (['req', 'request', 'event', 'ctx', 'context'].includes(root)) {
                         return true;
                     }
-                    // Generic user-controlled keyword check on root name.
                     for (const keyword of userControlledKeywords) {
                         if (root.includes(keyword))
                             return true;
@@ -250,12 +221,10 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
             }
             if (indexNode.type === 'Identifier') {
                 const varName = indexNode.name.toLowerCase();
-                // Check each part of the variable name against keywords Set
                 for (const keyword of userControlledKeywords) {
                     if (varName.includes(keyword))
                         return true;
                 }
-                // Trace variable definition
                 let currentScope = sourceCode.getScope(indexNode);
                 let variable = null;
                 while (currentScope) {
@@ -268,7 +237,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                     const def = variable.defs[0];
                     if (def.type === 'Variable' && def.node.init) {
                         const init = def.node.init;
-                        // Check MemberExpression involving user keywords (e.g. req.body.index)
                         if (init.type === 'MemberExpression') {
                             const objectText = sourceCode.getText(init.object).toLowerCase();
                             const propertyText = sourceCode.getText(init.property).toLowerCase();
@@ -277,32 +245,26 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                                 return true;
                             }
                         }
-                        // Check CallExpression with user-controlled arguments (Number(req.query.index), parseInt(), etc.)
                         if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                            // Check if callee is a type conversion function
                             const typeConversionFunctions = ['number', 'parseint', 'parsefloat', 'string', 'boolean'];
                             let isTypeConversion = false;
                             if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                                 isTypeConversion = typeConversionFunctions.includes(init.callee.name.toLowerCase());
                             }
-                            // If it's a type conversion, check if the argument is user-controlled
                             if (isTypeConversion && init.arguments.length > 0) {
                                 return isUserControlledIndex(init.arguments[0]);
                             }
                         }
-                        // Recursive check for Identifier assignment
                         if (init.type === 'Identifier' && init.name !== indexNode.name) {
                             return isUserControlledIndex(init);
                         }
                     }
                 }
             }
-            // Check CallExpression arguments (Number(req.query.index))
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                 const typeConversionFunctions = ['Number', 'parseInt', 'parseFloat', 'String', 'Boolean'];
                 if (indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     typeConversionFunctions.includes(indexNode.callee.name)) {
-                    // Check if arguments are user-controlled
                     for (const arg of indexNode.arguments) {
                         if (isUserControlledIndex(arg)) {
                             return true;
@@ -310,7 +272,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                     }
                 }
             }
-            // Check MemberExpression (req.query.index)
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
                 const text = sourceCode.getText(indexNode).toLowerCase();
                 const keywords = ['req.', 'request.', 'query.', 'params.', 'body.', 'input.', 'user.'];
@@ -320,32 +281,23 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
             }
             return false;
         };
-        /**
-         * Check if index has been validated
-         */
         const isIndexValidated = (indexNode) => {
-            // If it's a literal number, check if it's non-negative
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
                 return indexNode.value >= 0;
             }
-            // If it's an identifier, check if it comes from a bounds check function
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                 let current = indexNode;
-                // Walk up the AST to find where this variable was assigned
                 while (current) {
-                    // Check if we're in a variable declaration
                     if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator &&
                         current.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                         current.id.name === indexNode.name &&
                         current.init) {
                         const init = current.init;
-                        // Check if assigned from a bounds check function
                         if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                             init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                             boundsCheckFunctions.includes(init.callee.name)) {
                             return true;
                         }
-                        // Check if assigned from Math.min/max with buffer.length
                         if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                             init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                             init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -356,21 +308,19 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         }
                         break;
                     }
-                    // Check if it's a parameter in a function - assume validated if it's a function param
                     if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
                         current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
                         current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
                         const params = current.params;
                         for (const param of params) {
                             if (param.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && param.name === indexNode.name) {
-                                return true; // Function parameters are assumed validated
+                                return true;
                             }
                         }
                     }
                     current = current.parent;
                 }
             }
-            // Check if it's a call to a bounds check function directly
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                 indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 boundsCheckFunctions.includes(indexNode.callee.name)) {
@@ -378,24 +328,17 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
             }
             return false;
         };
-        /**
-         * Check if there's a bounds check in the current scope
-         */
         const hasBoundsCheck = (bufferName, indexNode) => {
-            // Look for bounds checks in the current function scope
             let current = indexNode;
             while (current) {
-                // Check if we're in a function
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
                     current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
                     current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
                     break;
                 }
-                // Look for if statements that check bounds
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
                     const condition = current.test;
                     const conditionText = sourceCode.getText(condition).toLowerCase();
-                    // Check for bounds checking patterns
                     if (conditionText.includes(`${bufferName}.length`) &&
                         (conditionText.includes('<') || conditionText.includes('<=') ||
                             conditionText.includes('>') || conditionText.includes('>=') ||
@@ -403,7 +346,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         return true;
                     }
                 }
-                // Look for variable declarations that might be bounds checks
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclaration) {
                     for (const declarator of current.declarations) {
                         if (declarator.init) {
@@ -416,7 +358,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Look for return statements or early returns that might indicate bounds checking
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement && current.argument) {
                     const returnText = sourceCode.getText(current.argument).toLowerCase();
                     if (returnText.includes(`${bufferName}.length`)) {
@@ -427,31 +368,20 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
             }
             return false;
         };
-        /**
-         * Check if index could be negative
-         */
         const couldBeNegative = (indexNode) => {
-            // Check for literal negative numbers
-            // Check for literal negative numbers
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
                 return indexNode.value < 0;
             }
-            // Check for unary minus expressions like -1, -10, etc.
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
                 indexNode.operator === '-' &&
                 indexNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
                 typeof indexNode.argument.value === 'number') {
-                return true; // -N is always negative for positive N
+                return true;
             }
-            // Check for binary expressions that could be negative like userInput - 10
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression && indexNode.operator === '-') {
-                // userInput - 10 could be negative, we can't be sure statically
-                return true; // Conservative: assume it could be negative
+                return true;
             }
-            // For variables, we can't be sure, but we can check for obvious patterns
             if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                // Check if this variable is assigned a negative value somewhere
-                // This is a simplified check - in practice we'd need more sophisticated analysis
                 let current = indexNode;
                 while (current) {
                     if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator && current.init) {
@@ -460,7 +390,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                             current.init.value < 0) {
                             return true;
                         }
-                        // Check for unary minus assignments
                         if (current.init.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
                             current.init.operator === '-' &&
                             current.init.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
@@ -474,17 +403,14 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
             return false;
         };
         return {
-            // Track buffer variable declarations
             VariableDeclarator(node) {
                 if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && node.init) {
                     const varName = node.id.name;
-                    // Check if assigned a buffer type
                     if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
                         node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                         bufferTypes.includes(node.init.callee.name)) {
                         bufferVars.add(varName);
                     }
-                    // Check if assigned from Buffer.from() or Buffer.alloc()
                     if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                         node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                         node.init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -493,7 +419,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         ['from', 'alloc', 'allocUnsafe'].includes(node.init.callee.property.name)) {
                         bufferVars.add(varName);
                     }
-                    // Check if assigned a buffer method result
                     if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                         const callee = node.init.callee;
                         if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
@@ -502,20 +427,16 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                             bufferVars.add(varName);
                         }
                     }
-                    // Check variable name patterns
                     if (bufferTypes.some(type => varName.toLowerCase().includes(type.toLowerCase()))) {
                         bufferVars.add(varName);
                     }
                 }
             },
-            // Check member expressions (buffer[index], buffer.method())
             MemberExpression(node) {
-                // Check for buffer[index] access
                 if (node.computed && node.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                     const bufferName = node.object.name;
                     const indexNode = node.property;
                     if (isBufferType(bufferName)) {
-                        // Check for negative indices
                         if (couldBeNegative(indexNode)) {
                             context.report({
                                 node,
@@ -527,9 +448,7 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                             });
                             return;
                         }
-                        // Check for user-controlled indices without validation
                         if (isUserControlledIndex(indexNode) && !isIndexValidated(indexNode)) {
-                            // Check if there's a bounds check in scope
                             if (!hasBoundsCheck(bufferName, indexNode)) {
                                 if (safetyChecker.isSafe(node, context)) {
                                     return;
@@ -545,7 +464,6 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                                 return;
                             }
                         }
-                        // Check if there's any bounds validation
                         if (!hasBoundsCheck(bufferName, indexNode) && !isIndexValidated(indexNode)) {
                             if (safetyChecker.isSafe(node, context)) {
                                 return;
@@ -561,25 +479,20 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check for buffer method calls that need bounds checking
                 if (node.property.type === 'Identifier' &&
                     bufferMethods.includes(node.property.name) &&
                     node.object.type === 'Identifier' &&
                     isBufferType(node.object.name)) {
-                    // This is a parent of a CallExpression, we'll check it there
                 }
             },
-            // Check buffer method calls
             CallExpression(node) {
                 const callee = node.callee;
-                // Check for buffer.slice() calls
                 if (callee.type === 'MemberExpression' &&
                     callee.property.type === 'Identifier' &&
                     callee.property.name === 'slice' &&
                     callee.object.type === 'Identifier' &&
                     isBufferType(callee.object.name)) {
                     const args = node.arguments;
-                    // Check slice arguments
                     for (const arg of args) {
                         if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
                             if (safetyChecker.isSafe(node, context)) {
@@ -596,14 +509,12 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check for buffer read/write methods
                 if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     bufferMethods.includes(callee.property.name) &&
                     callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     isBufferType(callee.object.name)) {
                     const args = node.arguments;
-                    // Check offset/length arguments
                     for (const arg of args) {
                         if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
                             if (safetyChecker.isSafe(node, context)) {
@@ -621,16 +532,12 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                     }
                 }
             },
-            // Check binary expressions that might involve buffer operations
             BinaryExpression(node) {
-                // Look for patterns like buffer.length - something that might indicate bounds checking
                 const leftText = sourceCode.getText(node.left);
                 const rightText = sourceCode.getText(node.right);
                 if (leftText.includes('.length') || rightText.includes('.length')) {
-                    // This might be a bounds check - we could analyze this further
                 }
             }
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-cryptojs/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noCryptojs = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -73,24 +68,22 @@ exports.noCryptojs = (0, eslint_devkit_1.createRule)({
                 suggest: [
                     {
                         messageId: 'useNativeCrypto',
-                        fix: () => null, // Complex migration
+                        fix: () => null,
                     },
                     {
                         messageId: 'useWebCrypto',
-                        fix: () => null, // Complex migration
+                        fix: () => null,
                     },
                 ],
             });
         }
         return {
-            // import CryptoJS from 'crypto-js'
             ImportDeclaration(node) {
                 if (typeof node.source.value === 'string' &&
                     (node.source.value === 'crypto-js' || node.source.value.startsWith('crypto-js/'))) {
                     reportDeprecatedLibrary(node);
                 }
             },
-            // const CryptoJS = require('crypto-js')
             CallExpression(node) {
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.name === 'require' &&
@@ -104,4 +97,3 @@ exports.noCryptojs = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-cryptojs-weak-random/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noCryptojsWeakRandom = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -63,19 +58,14 @@ exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
         function checkCallExpression(node) {
             if (isTestFile)
                 return;
-            // Check for CryptoJS.lib.WordArray.random()
-            // or WordArray.random()
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
                 const callee = node.callee;
-                // Check for .random() method
                 if (callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     callee.property.name === 'random') {
-                    // Check if it's on WordArray
                     if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && callee.object.name === 'WordArray') {
                         reportWeakRandom(node);
                         return;
                     }
-                    // Check for CryptoJS.lib.WordArray.random()
                     if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
                         const innerObj = callee.object;
                         if (innerObj.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -86,7 +76,6 @@ exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
                     }
                 }
             }
-            // Check for CryptoJS.random or similar patterns
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 node.callee.object.name === 'CryptoJS' &&
@@ -102,7 +91,7 @@ exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
                 suggest: [
                     {
                         messageId: 'useNativeRandom',
-                        fix: () => null, // Complex refactoring
+                        fix: () => null,
                     },
                 ],
             });
@@ -112,4 +101,3 @@ exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-data-in-temp-storage/index.js

@@ -1,14 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDataInTempStorage = void 0;
-/**
- * @fileoverview Prevent sensitive data in temp directories
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const DEFAULT_TEMP_PATHS = ['/tmp', '/var/tmp', 'temp/', '/temp'];
 exports.noDataInTempStorage = (0, eslint_devkit_1.createRule)({
@@ -65,7 +57,6 @@ exports.noDataInTempStorage = (0, eslint_devkit_1.createRule)({
         }
         return {
             CallExpression(node) {
-                // Detect fs.writeFileSync or fs.writeFile with temp path
                 if (node.callee.type === 'MemberExpression' &&
                     node.callee.object.type === 'Identifier' &&
                     node.callee.object.name === 'fs' &&
@@ -80,10 +71,8 @@ exports.noDataInTempStorage = (0, eslint_devkit_1.createRule)({
                 }
             },
             Literal(node) {
-                // Detect temp path literals
                 if (typeof node.value === 'string') {
                     if (tempPaths.some(tp => node.value.includes(tp))) {
-                        // Only flag if parent is assignment or variable declaration
                         const parent = node.parent;
                         if (parent?.type === 'VariableDeclarator' || parent?.type === 'AssignmentExpression') {
                             report(node);
@@ -94,4 +83,3 @@ exports.noDataInTempStorage = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-deprecated-buffer/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDeprecatedBuffer = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -48,11 +43,6 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
             return (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 node.name === 'Buffer');
         }
-        /**
-         * Returns the safe replacement for new Buffer(args):
-         *   new Buffer(number) → Buffer.alloc(number)
-         *   new Buffer(...)    → Buffer.from(...)
-         */
         function getBufferReplacement(args) {
             if (args.length === 1 &&
                 args[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
@@ -62,7 +52,6 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
             return 'Buffer.from';
         }
         return {
-            // Catches `new Buffer(size)` / `new Buffer(arr)` / `new Buffer('str')`
             NewExpression(node) {
                 if (!isBufferIdentifier(node.callee))
                     return;
@@ -71,8 +60,6 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
                     node,
                     messageId: 'deprecatedBufferConstructor',
                     fix(fixer) {
-                        // Replace `new Buffer` with `Buffer.from` or `Buffer.alloc`,
-                        // removing the `new` keyword in the process.
                         const sourceCode = context.sourceCode;
                         const newToken = sourceCode.getFirstToken(node);
                         const calleeEnd = node.callee.range[1];
@@ -80,7 +67,6 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
                     },
                 });
             },
-            // Catches `Buffer(size)` (factory call without `new`)
             CallExpression(node) {
                 if (!isBufferIdentifier(node.callee))
                     return;
@@ -96,4 +82,3 @@ exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-deprecated-cipher-method/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDeprecatedCipherMethod = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -64,11 +59,9 @@ exports.noDeprecatedCipherMethod = (0, eslint_devkit_1.createRule)({
         function checkCallExpression(node) {
             if (isTestFile)
                 return;
-            // Check for crypto.createCipher() or crypto.createDecipher()
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 DEPRECATED_METHODS.has(node.callee.property.name)) {
-                // Capture narrowed type before callback (TypeScript loses narrowing in closures)
                 const callee = node.callee;
                 const propertyNode = callee.property;
                 const methodName = propertyNode.name;
@@ -90,7 +83,6 @@ exports.noDeprecatedCipherMethod = (0, eslint_devkit_1.createRule)({
                     ],
                 });
             }
-            // Check for standalone createCipher() / createDecipher()
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 DEPRECATED_METHODS.has(node.callee.name)) {
                 const methodName = node.callee.name;
@@ -118,4 +110,3 @@ exports.noDeprecatedCipherMethod = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-dynamic-algorithm-selection/index.js

@@ -1,12 +1,7 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDynamicAlgorithmSelection = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/** Node crypto functions whose first argument is the algorithm name. */
 const CRYPTO_ALGORITHM_FUNCTIONS = new Set([
     'createHash',
     'createHmac',
@@ -25,9 +20,6 @@ exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-algorithm-selection.md',
             description: 'Disallow dynamic algorithm names in Node.js crypto functions (CWE-327)',
             cwe: 'CWE-327',
-            // Match the CVSS the finding emits: the message sets no per-message
-            // cvss, so it inherits CWE_MAPPING['CWE-327'] (7.5) via enrichFromCWE.
-            // Locked by security-cvss-docs-consistency.lock.test.ts.
             cvss: 7.5,
         },
         messages: {
@@ -48,7 +40,6 @@ exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
         return {
             CallExpression(node) {
                 const { callee, arguments: args } = node;
-                // Match crypto.method(algo) — MemberExpression where object is 'crypto'
                 if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression)
                     return;
                 if (callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
@@ -64,12 +55,9 @@ exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
                 const firstArg = args[0];
                 if (!firstArg)
                     return;
-                // String literal → already handled by no-weak-hash-algorithm for weak algos;
-                // a literal is always an intentional, auditable choice.
                 if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
                     typeof firstArg.value === 'string')
                     return;
-                // Template literal without expressions → equivalent to literal, safe.
                 if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
                     firstArg.expressions.length === 0)
                     return;
@@ -82,4 +70,3 @@ exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map