eslint-plugin-node-security 4.5.0 → 4.7.0

package/src/rules/no-ssrf/index.js

@@ -1,57 +1,34 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSsrf = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-// HTTP client functions that make outbound requests
 const HTTP_CLIENT_FUNCTIONS = new Set([
-    'fetch', // built-in / node-fetch
-    'got', // got
-    'nodeFetch', // node-fetch
-    'undici', // undici
+    'fetch',
+    'got',
+    'nodeFetch',
+    'undici',
 ]);
-// HTTP client method calls (e.g., axios.get, http.request)
 const HTTP_CLIENT_METHODS = new Set([
     'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'request',
 ]);
-// Object names that are HTTP client libraries
 const HTTP_CLIENT_OBJECTS = new Set([
-    'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici',
+    'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici', 'needle',
 ]);
-// Function names that indicate URL validation
 const VALIDATION_FUNCTION_NAMES = new Set([
     'validateUrl', 'validateURL', 'isValidUrl', 'isSafeUrl', 'isAllowed',
     'isValidURL', 'checkUrl', 'checkURL', 'sanitizeUrl', 'sanitizeURL',
 ]);
-// Substrings in identifier names that suggest user input
 const USER_INPUT_SUBSTRINGS = [
     'url', 'endpoint', 'uri', 'href', 'link',
     'target', 'dest', 'source', 'host',
     'user', 'input', 'param',
 ];
-/**
- * Check if a function parameter name suggests user input
- */
 function isUserInputParamName(name) {
     const lower = name.toLowerCase();
     return USER_INPUT_SUBSTRINGS.some(sub => lower.includes(sub));
 }
-// Object roots whose members carry attacker-controlled data in the common
-// server frameworks: Express `req`/`request`, Koa `ctx`, Lambda `event`.
 const REQUEST_ROOT_NAMES = new Set(['req', 'request', 'ctx', 'event']);
-// Keys of a Node `http.request(options)` object that actually name a URL.
-// `host`/`hostname`/`path`/`port` are deliberately absent: a helper that
-// parameterises them is ordinary internal plumbing, not evidence of user flow.
 const URL_OPTION_KEYS = new Set(['url', 'href', 'uri']);
-/**
- * True when the expression reads off a request object — `req.query.url`,
- * `ctx.request.body.target`, `event.queryStringParameters.u`. Everything
- * hanging off a request is untrusted, so the root name is the whole test.
- */
 function isRequestSourced(node) {
     let current = node;
     while (current.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
@@ -61,26 +38,6 @@ function isRequestSourced(node) {
         current.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
         REQUEST_ROOT_NAMES.has(current.name.toLowerCase()));
 }
-/**
- * Does the URL argument carry untrusted data into the request?
- *
- * The rule reports on evidence of flow, never on the mere presence of a
- * dynamic argument. Three shapes qualify:
- *
- *   1. The whole argument is a user-input-named identifier — `fetch(userUrl)`.
- *      This is the rule's documented naming heuristic: a bare identifier in
- *      URL position *is* the URL.
- *   2. Any part of the expression reads from a request object —
- *      `fetch(req.query.url)`, `https.request({ host: req.query.h })`.
- *   3. A template literal URL interpolates either of the above —
- *      `fetch(\`https://\${userHost}/x\`)`.
- *
- * Everything else is not evidence. In particular an options object whose
- * fields are plain locals — `https.request({ host, path, method: 'GET' })`,
- * benchmarks/corpus/CWE-444/safe/request-default-parser.js — used to be
- * reported unconditionally because a non-Identifier argument bypassed the
- * name gate entirely.
- */
 function carriesUntrustedUrl(node) {
     switch (node.type) {
         case eslint_devkit_1.AST_NODE_TYPES.Identifier:
@@ -89,15 +46,11 @@ function carriesUntrustedUrl(node) {
             return isRequestSourced(node);
         case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:
             return node.expressions.some(carriesUntrustedUrl);
-        // `new URL(userUrl)` / `String(req.query.url)` — inspect the arguments.
         case eslint_devkit_1.AST_NODE_TYPES.CallExpression:
         case eslint_devkit_1.AST_NODE_TYPES.NewExpression:
             return node.arguments.some(carriesUntrustedUrl);
-        // `'https://host' + userPath`
         case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:
             return carriesUntrustedUrl(node.left) || carriesUntrustedUrl(node.right);
-        // `http.request({ url: x, host: y })` — only URL-naming keys count by
-        // name; every other key still counts if its value is request-sourced.
         case eslint_devkit_1.AST_NODE_TYPES.ObjectExpression:
             return node.properties.some(property => {
                 if (property.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
@@ -116,24 +69,17 @@ function carriesUntrustedUrl(node) {
             return false;
     }
 }
-/**
- * AST-based check: does this node contain a validation pattern?
- * Walks the node tree looking for known validation constructs.
- */
 function nodeContainsValidation(node) {
-    // new URL(x) — URL constructor (parsing/validation)
     if (node.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
         node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
         node.callee.name === 'URL') {
         return true;
     }
-    // validateUrl(x), isValidUrl(x), etc.
     if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
         node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
         VALIDATION_FUNCTION_NAMES.has(node.callee.name)) {
         return true;
     }
-    // arr.includes(x), set.has(x), x.startsWith('...'), regex.test(x)
     if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
         node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
         node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
@@ -142,7 +88,6 @@ function nodeContainsValidation(node) {
             return true;
         }
     }
-    // hostname === '...' or host === '...'
     if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression &&
         (node.operator === '===' || node.operator === '==') &&
         ((node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
@@ -153,13 +98,10 @@ function nodeContainsValidation(node) {
                 (node.right.property.name === 'hostname' || node.right.property.name === 'host')))) {
         return true;
     }
-    // throw new Error(...) — guard clause
     if (node.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement) {
         return true;
     }
-    // Keys to skip: non-child properties that cause circular refs or aren't AST children
     const SKIP_KEYS = new Set(['parent', 'range', 'loc', 'tokens', 'comments', 'start', 'end']);
-    // Recurse into child nodes
     for (const key of Object.keys(node)) {
         if (SKIP_KEYS.has(key))
             continue;
@@ -179,11 +121,7 @@ function nodeContainsValidation(node) {
     }
     return false;
 }
-/**
- * Check if there is URL validation before the HTTP call using AST walking
- */
 function hasValidationBefore(node) {
-    // Walk up to find the containing block
     let current = node.parent;
     while (current) {
         const parent = current.parent;
@@ -192,14 +130,12 @@ function hasValidationBefore(node) {
         if (parent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement || parent.type === eslint_devkit_1.AST_NODE_TYPES.Program) {
             const body = parent.body;
             const idx = body.indexOf(current);
-            // Check previous sibling statements for validation patterns
             for (let i = idx - 1; i >= 0 && i >= idx - 10; i--) {
                 if (nodeContainsValidation(body[i])) {
                     return true;
                 }
             }
         }
-        // Check if inside an if-block where the condition contains validation
         if (parent.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement && parent.test) {
             if (nodeContainsValidation(parent.test)) {
                 return true;
@@ -253,12 +189,10 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
         return {
             CallExpression(node) {
                 let isHttpCall = false;
-                // 1. Direct function call: fetch(url), got(url)
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     HTTP_CLIENT_FUNCTIONS.has(node.callee.name)) {
                     isHttpCall = true;
                 }
-                // 2. Method call: axios.get(url), http.request(url)
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -268,19 +202,12 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
                 }
                 if (!isHttpCall)
                     return;
-                // Check the first argument (the URL)
                 const urlArg = node.arguments[0];
                 if (!urlArg)
                     return;
-                // Static URLs — fetch('https://api.example.com'), fetch(`https://…`) —
-                // carry nothing untrusted and fall out at the evidence gate below.
-                // Check if there is URL validation before this call
                 if (hasValidationBefore(node)) {
                     return;
                 }
-                // Require evidence that untrusted data reaches the URL. Applies to
-                // every argument shape — an options object or a template literal used
-                // to bypass this gate entirely and report unconditionally.
                 if (!carriesUntrustedUrl(urlArg)) {
                     return;
                 }
@@ -292,4 +219,3 @@ exports.noSsrf = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-static-iv/index.js

@@ -1,18 +1,10 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noStaticIv = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/**
- * Patterns that indicate a hardcoded IV
- */
 const STATIC_IV_PATTERNS = [
-    /^[0-9a-f]+$/i, // Hex string
-    /^[A-Za-z0-9+/]+=*$/, // Base64
+    /^[0-9a-f]+$/i,
+    /^[A-Za-z0-9+/]+=*$/,
 ];
 exports.noStaticIv = (0, eslint_devkit_1.createRule)({
     name: 'no-static-iv',
@@ -67,10 +59,8 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
         const { allowInTests = false } = options;
         const filename = context.filename;
         const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        // Track variables assigned from randomBytes
         const randomIvVariables = new Set();
         function checkVariableDeclarator(node) {
-            // Track: const iv = crypto.randomBytes(16)
             if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 node.init?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
                 const init = node.init;
@@ -88,7 +78,6 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
         function checkCallExpression(node) {
             if (isTestFile)
                 return;
-            // Check for createCipheriv calls
             const isCipherivCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 (node.callee.property.name === 'createCipheriv' || node.callee.property.name === 'createDecipheriv')) ||
@@ -100,14 +89,12 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
             }
         }
         function checkIvArgument(ivArg) {
-            // Check for string literal IV
             if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof ivArg.value === 'string') {
                 const value = ivArg.value;
                 if (STATIC_IV_PATTERNS.some(p => p.test(value)) || value.length >= 8) {
                     reportStaticIv(ivArg);
                 }
             }
-            // Check for Buffer.from('static')
             if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                 ivArg.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 ivArg.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -118,7 +105,6 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
                 if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string') {
                     reportStaticIv(ivArg);
                 }
-                // Check for new Uint8Array([...])
                 if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression) {
                     const allLiterals = firstArg.elements.every((el) => el?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof el.value === 'number');
                     if (allLiterals) {
@@ -126,11 +112,7 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
                     }
                 }
             }
-            // Check for variable reference that's NOT from randomBytes
             if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                // If we've tracked this variable as coming from randomBytes, it's OK
-                // Otherwise, we can't be sure - only flag if we have evidence it's static
-                // For now, we don't report variables as we can't always determine their source
             }
         }
         function reportStaticIv(node) {
@@ -145,4 +127,3 @@ exports.noStaticIv = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-timing-unsafe-compare/index.js

@@ -1,18 +1,11 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noTimingUnsafeCompare = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const DEFAULT_SECRET_PATTERNS = [
-    // Common secret names (camelCase, snake_case, kebab-case)
     'token', 'secret', 'key', 'password', 'hash', 'signature',
     'mac', 'hmac', 'digest', 'apiKey', 'api_key', 'api-key',
     'auth', 'credential', 'bearer', 'jwt', 'csrf', 'nonce',
-    // PII and sensitive data patterns
     'ssn', 'social_security', 'social-security',
     'pii', 'private_key', 'private-key', 'privateKey',
     'access_token', 'access-token', 'accessToken',
@@ -87,12 +80,10 @@ exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
             return false;
         }
         function checkBinaryExpression(node) {
-            // Check for === or == comparisons
             if (node.operator !== '===' && node.operator !== '==' &&
                 node.operator !== '!==' && node.operator !== '!=') {
                 return;
             }
-            // Check if either side looks like a secret
             const leftIsSecret = isSecretIdentifier(node.left);
             const rightIsSecret = isSecretIdentifier(node.right);
             if (leftIsSecret || rightIsSecret) {
@@ -102,7 +93,7 @@ exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
                     suggest: [
                         {
                             messageId: 'useTimingSafeEqual',
-                            fix: () => null, // Complex refactoring
+                            fix: () => null,
                         },
                     ],
                 });
@@ -113,4 +104,3 @@ exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-toctou-vulnerability/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noToctouVulnerability = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -86,11 +81,7 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
             return {};
         }
         const sourceCode = context.sourceCode;
-        /**
-         * Check for TOCTOU patterns
-         */
         function checkCallExpression(node) {
-            // 1. Identify the file operation (Use)
             let useMethodName = '';
             if (node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier') {
                 const objectName = node.callee.object.type === 'Identifier' ? node.callee.object.name : '';
@@ -108,22 +99,14 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
             const useArg = node.arguments[0];
             if (!useArg)
                 return;
-            // 2. Walk up to find the condition (Check)
             let current = node.parent;
             while (current) {
                 if (current.type === 'IfStatement') {
-                    // Extract the condition node
                     let condition = current.test;
-                    // Handle negated condition: if (!exists(path)) { create(path) } -> also TOCTOU but different logic? 
-                    // Actually TOCTOU is usually Check(exists) -> Use(read).
-                    // If (!exists) -> create is Check -> Use.
-                    // But strict TOCTOU is checking state then acting.
-                    // If checking for negation
                     if (condition.type === 'UnaryExpression' && condition.operator === '!') {
                         condition = condition.argument;
                     }
                     if (condition.type === 'CallExpression') {
-                        // Check if it's a file check method
                         let checkMethodName = '';
                         if (condition.callee.type === 'MemberExpression' && condition.callee.property.type === 'Identifier') {
                             checkMethodName = condition.callee.property.name;
@@ -133,15 +116,12 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
                         }
                         const checkMethods = ['existsSync', 'statSync', 'accessSync', 'exists', 'stat', 'access'];
                         if (checkMethods.includes(checkMethodName)) {
-                            // Compare arguments
                             const checkArg = condition.arguments[0];
                             if (checkArg) {
-                                // Method 1: Identifier match (same variable)
                                 if (checkArg.type === 'Identifier' && useArg.type === 'Identifier' && checkArg.name === useArg.name) {
                                     reportToctou(node);
                                     return;
                                 }
-                                // Method 2: Text match (fallback)
                                 const checkArgText = sourceCode.getText(checkArg).replace(/\s/g, '');
                                 const useArgText = sourceCode.getText(useArg).replace(/\s/g, '');
                                 if (checkArgText === useArgText) {
@@ -150,7 +130,6 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
                                 }
                             }
                         }
-                        // Handle stats.isFile() / stats.isDirectory() pattern
                         if (condition.callee.type === 'MemberExpression' &&
                             condition.callee.property.type === 'Identifier' &&
                             ['isFile', 'isDirectory'].includes(condition.callee.property.name) &&
@@ -214,4 +193,3 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-unsafe-buffer-alloc/index.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noUnsafeBufferAlloc = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const UNSAFE_ALLOCATORS = new Set(['allocUnsafe', 'allocUnsafeSlow']);
+exports.noUnsafeBufferAlloc = (0, eslint_devkit_1.createRule)({
+    name: 'no-unsafe-buffer-alloc',
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-buffer-alloc.md',
+            description: 'Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory',
+            cwe: 'CWE-908',
+            cweJustification: 'CWE-908 (Use of Uninitialized Resource) — allocUnsafe returns a view over non-zeroed heap memory; any byte not overwritten before the buffer is read or transmitted discloses prior process memory.',
+            cvss: 7.5,
+            confidence: 'high',
+        },
+        messages: {
+            unsafeAlloc: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Uninitialized Buffer Allocation',
+                cwe: 'CWE-908',
+                cvss: 7.5,
+                description: '`Buffer.allocUnsafe(size)` returns memory that has not been zeroed. Every byte not overwritten before the buffer is read or sent leaks whatever the allocator previously stored there.',
+                severity: 'HIGH',
+                fix: 'Use `Buffer.alloc(size)` (zero-filled), or keep `allocUnsafe` only where the very next statement overwrites the whole buffer — `Buffer.allocUnsafe(size).fill(0)` is accepted by this rule.',
+                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize',
+            }),
+            unsafeAllocSlow: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Uninitialized Buffer Allocation (allocUnsafeSlow)',
+                cwe: 'CWE-908',
+                cvss: 7.5,
+                description: '`Buffer.allocUnsafeSlow(size)` allocates outside the shared pool but is equally uninitialized — the returned bytes are whatever was last in that memory.',
+                severity: 'HIGH',
+                fix: 'Use `Buffer.alloc(size)`, or append `.fill(0)` to zero the allocation at the call site.',
+                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafeslowsize',
+            }),
+            useSafeAlloc: 'Replace with `Buffer.alloc()` (zero-filled).',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        function isFilledInPlace(node) {
+            const parent = node.parent;
+            if (parent?.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+                parent.object !== node ||
+                parent.computed ||
+                parent.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                parent.property.name !== 'fill') {
+                return false;
+            }
+            const grandparent = parent.parent;
+            return (grandparent?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                grandparent.callee === parent);
+        }
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+                    callee.computed ||
+                    callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                    callee.object.name !== 'Buffer' ||
+                    callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+                    !UNSAFE_ALLOCATORS.has(callee.property.name)) {
+                    return;
+                }
+                if (isFilledInPlace(node))
+                    return;
+                context.report({
+                    node,
+                    messageId: callee.property.name === 'allocUnsafe'
+                        ? 'unsafeAlloc'
+                        : 'unsafeAllocSlow',
+                    suggest: [
+                        {
+                            messageId: 'useSafeAlloc',
+                            fix: (fixer) => fixer.replaceText(callee.property, 'alloc'),
+                        },
+                    ],
+                });
+            },
+        };
+    },
+});

package/src/rules/no-unsafe-dynamic-require/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noUnsafeDynamicRequire = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -49,14 +44,7 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
         },
     ],
     create(context) {
-        /**
-         * Track variables that reference require
-         * Maps variable name to the node where it was assigned
-         */
         const requireVariables = new Set();
-        /**
-         * Check if a node is a reference to require
-         */
         const isRequireReference = (node) => {
             if (node.type === 'Identifier' && node.name === 'require') {
                 return true;
@@ -66,10 +54,6 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
             }
             return false;
         };
-        /**
-         * Check if argument is dynamic (not a literal)
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isDynamicArgument = (arg) => {
             if (arg.type === 'Literal')
                 return false;
@@ -79,7 +63,6 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
         };
         return {
             VariableDeclarator(node) {
-                // Track when require is assigned to a variable
                 if (node.id.type === 'Identifier' && node.init) {
                     if (node.init.type === 'Identifier' && node.init.name === 'require') {
                         requireVariables.add(node.id.name);
@@ -87,21 +70,17 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
                 }
             },
             CallExpression(node) {
-                // Check for require() calls (direct or via variable)
                 if (node.callee.type !== 'Identifier') {
                     return;
                 }
-                // Check if callee is require or a variable that references require
                 if (!isRequireReference(node.callee)) {
                     return;
                 }
-                // Must have at least one argument
                 if (node.arguments.length === 0)
                     return;
                 const firstArg = node.arguments[0];
                 if (firstArg.type === 'SpreadElement')
                     return;
-                // Check if dynamic
                 if (!isDynamicArgument(firstArg))
                     return;
                 context.report({
@@ -112,4 +91,3 @@ exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-weak-cipher-algorithm/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noWeakCipherAlgorithm = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -45,17 +40,12 @@ const WEAK_CIPHER_PATTERNS = [
         replacement: 'aes-256-gcm',
     },
 ];
-/**
- * Check if a string contains a weak cipher algorithm
- */
 function findWeakCipher(value, additionalPatterns) {
-    // Check standard patterns
     for (const pattern of WEAK_CIPHER_PATTERNS) {
         if (pattern.pattern.test(value)) {
             return pattern;
         }
     }
-    // Check additional patterns
     for (const additionalPattern of additionalPatterns) {
         const regex = new RegExp(`\\b${additionalPattern}\\b`, 'i');
         if (regex.test(value)) {
@@ -137,28 +127,20 @@ exports.noWeakCipherAlgorithm = (0, eslint_devkit_1.createRule)({
         const { additionalWeakCiphers = [], allowInTests = false, } = options;
         const filename = context.filename;
         const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        /**
-         * Check if a call expression uses a weak cipher
-         */
         function checkCallExpression(node) {
             if (isTestFile)
                 return;
             const cipherMethods = new Set(['createCipher', 'createCipheriv', 'createDecipher', 'createDecipheriv']);
-            // Check for crypto.createCipher*() pattern
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 cipherMethods.has(node.callee.property.name)) {
                 checkCipherArgument(node);
             }
-            // Check for standalone createCipher*() pattern
             if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 cipherMethods.has(node.callee.name)) {
                 checkCipherArgument(node);
             }
         }
-        /**
-         * Check the algorithm argument passed to createCipher*
-         */
         function checkCipherArgument(node) {
             const firstArg = node.arguments[0];
             if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string') {
@@ -190,4 +172,3 @@ exports.noWeakCipherAlgorithm = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map