eslint-plugin-node-security 4.5.0 → 4.7.0

package/CHANGELOG.md

@@ -1,384 +0,0 @@
-## [4.1.0] - 2026-05-03
-
-## 4.5.0
-
-### Minor Changes
-
-- [#310](https://github.com/ofri-peretz/eslint/pull/310) [`28d7898`](https://github.com/ofri-peretz/eslint/commit/28d789896b06dd13ac7c50bcb4aaa36fa5e4be29) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Add `no-timing-unsafe-compare` to the `recommended` preset, restoring CWE-697
-  coverage.
-
-  `secure-coding/no-insecure-comparison` was removed from every `secure-coding`
-  preset, with `node-security/no-timing-unsafe-compare` named as the replacement.
-  But that rule was not in any `recommended` preset, so the practical result was
-  that **no `recommended` preset anywhere covered CWE-697 timing-unsafe
-  comparison**, and the migration note pointed users at a rule they would have had
-  to enable by hand — which the note did not say.
-
-  It enters at `'warn'` rather than `'error'`, matching the precedent already set
-  by `no-deprecated-buffer` in this preset: adopters shouldn't have CI turn red on
-  a version bump. Promote to `'error'` on the next major.
-
-  Note the coverage now lives in a different package than before. A project that
-  installs only `eslint-plugin-secure-coding` and relied on its presets for this
-  check needs `eslint-plugin-node-security` as well.
-
-  A lock test in `src/index.test.ts` fails if the rule leaves `recommended` again,
-  since that would silently make the migration note false.
-
-- [#288](https://github.com/ofri-peretz/eslint/pull/288) [`89bea05`](https://github.com/ofri-peretz/eslint/commit/89bea05c6c48f5f1bdbcc3c87b301d967d962051) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut false positives in five security rules, measured against a 1,470-file corpus (webpack `lib/`, lodash, eslint-plugin-import `src/`, and two NestJS boilerplates).
-
-  **`secure-coding/no-hardcoded-credentials` — decide on the value, not the key name.** The rule reported any string in a credential-named slot, so `errors: { password: 'incorrectPassword' }` (an i18n error key) was a CVSS 9.8 finding — 5 of its 10 corpus hits. Detection is now driven by the value's shape: entropy, character-class mix, charset, and a "natural word string" test that rejects identifier- and message-shaped values. A credential-shaped name is still consulted, but only to promote an already-secret-shaped value. Corpus: **10 → 7 findings, and all 7 are true positives** — including two the old logic missed, because a 25-character random `key:` is now found by shape rather than by being on a name allowlist.
-
-  **`secure-coding/no-unsafe-deserialization` — `setTimeout` is not a deserializer.** `await new Promise(resolve => setTimeout(resolve, 1000))` was rated CVSS 9.8 CRITICAL. `setTimeout` / `setInterval` now only report in their implied-`eval` form (string first argument), and calls inside a function named `deserialize` / `unserialize` / `fromJSON` / `fromBuffer` — a class implementing a serialization protocol — are exempt. Corpus: **35 → 4**.
-
-  **`secure-coding/no-graphql-injection` — require real GraphQL syntax.** Any template literal containing a nested brace or the word `type` was a CVSS 9.8 GraphQL injection. Operation and schema keywords must now start a line, schema keywords require a body, and a bare selection set must be the entire string. Concatenations are matched on their reassembled static value rather than on their source text. Corpus: **41 → 0**.
-
-  **`node-security/require-secure-deletion` — only sensitive properties.** The rule fired on every `delete obj.prop`. It now reports only a statically known, sensitive property name (`password`, `token`, `apiKey`, `privateKey`, `sessionId`, …), configurable via the new `additionalSensitiveProperties` option, and understands computed access and optional chaining. Corpus: **25 → 1** (a genuine `delete userDto.oldPassword`).
-
-  **`secure-coding/no-insecure-comparison` — removed from `recommended`, `recommended-strict` and `owasp-top-10`.** It is deprecated in favour of `node-security/no-timing-unsafe-compare`, and its loose-equality half re-reports core `eqeqeq` under a CWE-697 banner — 433 corpus findings, all duplicates. No narrowing fixes that, so the honest change is to stop switching it on for people; it remains exported and available via `strict` or explicit opt-in. Its timing-attack half was also narrowed to match secret keywords on identifier **word segments** instead of substrings of the whole expression text, which stops `if (key === "__non_webpack_require__")` (and `monkey`, `keyword`, `machine`, `author`) from being reported: **443 → 221**.
-
-### Patch Changes
-
-- [#294](https://github.com/ofri-peretz/eslint/pull/294) [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Rewrite `description` and `keywords` on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.
-
-  **Descriptions now lead with the search phrase.** Every one starts `ESLint plugin for <the thing you'd search>` instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:
-
-  - `eslint-plugin-import-next` claimed "100x faster no-cycle detection". No 100x measurement exists: `CLAIMS.md` records **3.1x end-to-end** (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
-  - `eslint-plugin-secure-coding` claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
-  - `eslint-plugin-secure-coding` ("89 rules") and `eslint-plugin-react-a11y` ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into `interlace-numbers.json`; hand-typed copies are removed rather than corrected.
-
-  **Keywords now match the vocabulary of the plugins that rank.** `eslint-plugin-security`, `eslint-plugin-jsx-a11y`, `eslint-plugin-n` and `eslint-plugin-import` all carry the `eslint` / `eslintplugin` / `eslint-plugin` trio — six of our packages were missing `eslintplugin`, and every one now carries all three plus `static-analysis`, `linting` and `code-quality`. Security plugins add `sast`, `appsec` and `vulnerability`; `node-security` and `secure-coding` also carry `nodesecurity`, the exact keyword `eslint-plugin-security` ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (`cwe-78` command injection, `cwe-22` path traversal, `cwe-89` SQL injection, `cwe-79` XSS, `cwe-347` JWT algorithm confusion, `cwe-352` CSRF, `cwe-943` NoSQL injection), and `node-security` gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (`crypto`, `cryptography`, `weak-hash`, `md5`, `sha1`, `timing-attack`).
-
-  No rule behavior, exports, or configuration changes.
-
-- [#296](https://github.com/ofri-peretz/eslint/pull/296) [`0c7a208`](https://github.com/ofri-peretz/eslint/commit/0c7a208f568436cc55ac6732641df46e8f44af1f) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Cut two false positives confirmed against the benchmark corpus SAFE fixtures.
-
-  **`node-security/no-ssrf`** — the user-input gate only ran when the URL argument
-  was a bare identifier, so every other shape reported unconditionally. A Node
-  options object built from a helper's own parameters —
-  `https.request({ host, path, method: 'GET' })`, from
-  `benchmarks/corpus/CWE-444/safe/request-default-parser.js` — was flagged with no
-  user data anywhere in the flow.
-
-  The gate now applies to every argument shape and requires evidence: a
-  user-input-named identifier standing as the URL, a read off a request object
-  (`req` / `request` / `ctx` / `event`), or a template literal or concatenation
-  interpolating either. Options-object fields count when they are request-sourced,
-  or when a `url` / `href` / `uri` key holds a user-input-named identifier.
-
-  Newly ignored: options objects and interpolations built purely from locals.
-  Still reported: `fetch(userUrl)`, `fetch(req.query.url)`,
-  `https.request({ host: req.query.host })`, ``fetch(`https://${userHost}/x`)``.
-
-  **`secure-coding/no-hardcoded-credentials`** — `secret: '<your-secret-here>'`
-  from `benchmarks/corpus/CWE-798/safe/test-placeholder-values.js` was reported at
-  CVSS 9.8. The angle brackets are two character classes, which is all the shape
-  gate asks for once the slot is credential-named.
-
-  Self-evident placeholders are now skipped: bracketed template slots (`<…>`,
-  `{{…}}`, `${…}`, `[…]`), placeholder words standing as their own token
-  (`changeme`, `YOUR_API_KEY`, `example`), and one character repeated
-  (`xxxxxxxxxxxx`). Whole-token matching only, so a real secret that merely
-  contains such a substring is unaffected.
-
-  The allowlist applies to non-structural findings only — a JWT, an `sk_live_`
-  key, or a `postgres://user:pass@host` string still reports whatever words it
-  contains. Set the new `allowPlaceholders: false` option to restore the previous
-  behaviour.
-
-- Updated dependencies [[`e1cdf83`](https://github.com/ofri-peretz/eslint/commit/e1cdf83e3db761907f0ab06f7fc6c1f1da7513a5), [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358)]:
-  - @interlace/eslint-devkit@1.4.3
-
-## 4.4.3
-
-### Patch Changes
-
-- [#269](https://github.com/ofri-peretz/eslint/pull/269) [`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - docs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes.
-
-- Updated dependencies [[`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad)]:
-  - @interlace/eslint-devkit@1.4.2
-
-## 4.4.2
-
-### Patch Changes
-
-- [#252](https://github.com/ofri-peretz/eslint/pull/252) [`d67e395`](https://github.com/ofri-peretz/eslint/commit/d67e3953c2748ad36e6aebe0f24b1d04e518b4d0) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Fix Codecov badge showing "unknown" — switch from flag to component URL format
-
-## 4.4.1
-
-### Patch Changes
-
-- [#225](https://github.com/ofri-peretz/eslint/pull/225) [`34ff5a8`](https://github.com/ofri-peretz/eslint/commit/34ff5a8e6f5126c5d1c0a524759e0af2b5476b46) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - CI-only: pin all coverage thresholds at 100% (integration target, merges last).
-
-## 4.4.0
-
-### Minor Changes
-
-- [#190](https://github.com/ofri-peretz/eslint/pull/190) [`6bb476d`](https://github.com/ofri-peretz/eslint/commit/6bb476d232f85da8201b08d0a199c9267c3499e5) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat(node-security): add `no-dynamic-algorithm-selection` (CWE-327)
-
-  Disallow dynamic (non-literal) algorithm names in Node.js crypto functions.
-  A runtime-selected algorithm argument can allow a downgrade to a broken or
-  risky cryptographic algorithm (CWE-327: Use of a Broken or Risky
-  Cryptographic Algorithm). AST-structural — flags non-literal algorithm
-  arguments to the crypto APIs.
-
-### Patch Changes
-
-- [#215](https://github.com/ofri-peretz/eslint/pull/215) [`f42ea93`](https://github.com/ofri-peretz/eslint/commit/f42ea935555a558627dd61d1b013cd8509943c89) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Align `no-dynamic-algorithm-selection`'s `meta.docs.cvss` (7.4) to the CVSS its
-  finding actually emits. The rule's message carries `CWE-327` and sets no
-  per-message `cvss`, so it inherits `CWE_MAPPING['CWE-327']` = 7.5 via
-  `enrichFromCWE` — docs now match the emitted value. Surfaced by the
-  cross-plugin `security-cvss-docs-consistency.lock.test.ts` lock (added in [#213](https://github.com/ofri-peretz/eslint/issues/213)),
-  which turned main red when this rule landed concurrently with the CVSS sweep.
-  Documentation-metadata only; no emitted finding changes.
-
-- [#213](https://github.com/ofri-peretz/eslint/pull/213) [`391dbe6`](https://github.com/ofri-peretz/eslint/commit/391dbe6b39f78d549379218567cb959649f8c614) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Align every security rule's `meta.docs.cvss` to the CVSS its finding actually
-  emits. The emitted machine-readable message sources its `CVSS:x` from
-  `CWE_MAPPING` via `formatLLMMessage` → `enrichFromCWE`, but the static
-  `meta.docs.cvss` documentation field had drifted on 45 rules across these 7
-  plugins — e.g. `no-hardcoded-credentials` documented `9.5` while emitting
-  `CVSS:9.8` (the value the published article and SARIF/LLM consumers already
-  read).
-
-  This corrects the **documentation metadata only** — no emitted finding changes.
-  Locked by `security-cvss-docs-consistency.lock.test.ts` (cross-plugin: every
-  security rule's `meta.docs.cvss` must equal the CVSS it emits), the
-  `no-hardcoded-credentials` rule lock (real ESLint `Linter` emission), and a
-  devkit `enrichFromCWE` contract test pinning `CWE-798 → 9.8`.
-
-  Follow-up (not in scope): 50 security rules document a CVSS that never appears
-  in any emitted message (their messages carry no CWE), and several rules emit the
-  generic CWE score where a rule-specific score may be warranted — both change
-  emitted output and are separate decisions.
-
-## 4.3.0
-
-### Minor Changes
-
-- [#148](https://github.com/ofri-peretz/eslint/pull/148) [`82718c2`](https://github.com/ofri-peretz/eslint/commit/82718c282895710d42c36d4679fb24d47f1c35c7) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat(node-security): add `no-math-random-crypto` (CWE-338)
-
-  Detects `Math.random()` used in cryptographic contexts (tokens, keys, secrets,
-  salts, IVs, session IDs) and steers to `crypto.randomBytes()` / `crypto.randomUUID()`.
-
-  This was the one cryptography rule that the deprecated `eslint-plugin-crypto`
-  shipped but had **not** been carried into `node-security` during the 2026-05
-  consolidation — so `eslint-plugin-crypto`'s deprecation notice ("node-security
-  includes all cryptography rules") was previously inaccurate. It is now true.
-
-  Added to the `recommended` preset as `error`. The detection is return/assignment
-  context-aware (matches `crypto`-named variables, properties, and function
-  returns) so benign uses like a Fisher-Yates shuffle into a non-crypto variable
-  do not false-positive — verified against the fn-fp benchmark (40/40 detection,
-  0 false positives with the crypto-free fleet).
-
-### Patch Changes
-
-- [#144](https://github.com/ofri-peretz/eslint/pull/144) [`8843ce7`](https://github.com/ofri-peretz/eslint/commit/8843ce7fbb465caad161b97032467b3a37a49319) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: ILB-Wild FP reduction + doc examples + doc-test-alignment scanner fixes
-
-  **`no-unlimited-resource-allocation` — FP reduction (430 Edge FPs)**
-  - Skip loop-allocation reporting when the first argument is a numeric literal (e.g. `Buffer.alloc(1024)` inside a loop is statically bounded, not a risk)
-  - Skip `Array.isArray`, `Array.from`, `Array.of` calls in the `alloc/Array` pattern check (these don't allocate unbounded memory)
-
-  **`no-hardcoded-credentials` — FP reduction (~280 Edge FPs)**
-  - Extended test-file skip to cover `.fixture.`, `.mock.`, `__mocks__/`, `/tests/`, `/fixtures/`, `/mocks/` paths
-  - Skip string literals that are fallback values in `process.env.X || 'fallback'` expressions — the secret lives in the environment, the string is only a dev-mode default
-
-  **Doc examples — 4 rules now have ❌ Incorrect examples**
-  - `lambda-security/no-missing-authorization-check`
-  - `lambda-security/no-overly-permissive-iam-policy`
-  - `node-security/prefer-native-crypto` (renamed non-standard `### ❌ Third-Party (Flagged)` to `### ❌ Incorrect`)
-  - `vercel-ai-security/require-tool-confirmation` (replaced placeholder with a real tested example)
-
-  **`ilb-doc-test-alignment` scanner fixes**
-  - Accept both `## ❌` and `### ❌` headings (docs use H3 under an H2 `## Examples` section; was only finding H2)
-  - Slice from end-of-line rather than end-of-regex-match (prevents `## ❌ Incorrect Code` from leaving a partial heading in the parsed section)
-
-  Result: `ilb:doc-test-alignment` → 206 ok, 0 doc has no ❌ examples (was 165 missing).
-
-- [#141](https://github.com/ofri-peretz/eslint/pull/141) [`38ab670`](https://github.com/ofri-peretz/eslint/commit/38ab670a0221684f4fd3d5dc3c05ddec7458ca2b) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: remove false `meta.fixable: 'code'` declarations from 21 rules that had no `fix()` function
-
-  Rules that declared `fixable: 'code'` in their ESLint meta without an actual `fix()` implementation would show the ⚡ auto-fix icon in editors and CI formatters but apply no change when `--fix` was run. This patch removes the misleading declaration from:
-  - `browser-security/no-clickjacking`
-  - `import-next/first`, `named`, `no-barrel-import`, `no-import-module-exports`, `no-namespace`
-  - `node-security/no-buffer-overread`, `no-unsafe-dynamic-require`, `no-zip-slip`
-  - `react-features/react-no-inline-functions`
-  - `reliability/no-jsdoc-terminator-in-example` (uses `suggest`, not auto-fix; corrected to `hasSuggestions: true` only)
-  - `secure-coding/no-directive-injection`, `no-electron-security-issues`, `no-graphql-injection`, `no-improper-sanitization`, `no-improper-type-validation`, `no-ldap-injection`, `no-unchecked-loop-condition`, `no-unlimited-resource-allocation`, `no-weak-password-recovery`, `no-xpath-injection`
-
-- [#186](https://github.com/ofri-peretz/eslint/pull/186) [`edf208d`](https://github.com/ofri-peretz/eslint/commit/edf208d67ac2357312c97d8964fcf6a462e407eb) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Consolidation cleanup — no rule behavior change:
-  - **react-features**: the README rules table now lists the 8 `componentApi`
-    preset rules. The README generator (`sync-readme-rules.ts`) and the
-    `plugin-rule-source-drift` validator now recurse into nested
-    `docs/rules/<category>/` subfolders, so every documented rule is advertised
-    consistently (previously the nested componentApi docs were silently dropped,
-    which an earlier `readme` exception had papered over — that exception is now
-    removed in favour of the real fix).
-  - **node-security**: remove the orphaned `no-pii-in-logs` rule source — the rule
-    was migrated to `eslint-plugin-secure-coding` and is no longer exported here;
-    the dead source was still compiling into `dist`.
-  - **import-next**: restore the `no-cycle` unit test after [#180](https://github.com/ofri-peretz/eslint/issues/180)'s SCC refactor
-    (`computeSCCsFromFile` + `findShortestCyclePath` are now bridged in the mock).
-
-  Also fixes `scripts/ilb-plugin-scope-audit.ts` to stop mis-reading config-preset
-  keys (`'recommended-strict': {`) as rules.
-
-- [#148](https://github.com/ofri-peretz/eslint/pull/148) [`82718c2`](https://github.com/ofri-peretz/eslint/commit/82718c282895710d42c36d4679fb24d47f1c35c7) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - feat+fix: ILB-Wild FP reduction + two new quality rules
-
-  **`no-unsafe-deserialization` FP reduction (~112 FPs)**
-  - Track `fs.readFileSync('literal')` calls in `literalPathFileVars` — a file read with a
-    hardcoded path (bundled config) is not user-controlled input for safe deserializers
-    (`JSON.parse`, schema-validating parsers). `eval()` still fires even on literal-path reads.
-
-  **`no-buffer-overread` FP reduction (~129 FPs)**
-  - Remove `b` (single-char, too broad) and `chunk` (too common for array chunks) from the
-    Buffer alias heuristic — `isBufferType` now only matches `buf` and `bytes` by name,
-    reducing false matches on non-Buffer variables.
-
-  **New rule: `modernization/prefer-template-literal`**
-  - Flags `"string " + variable` concatenation and suggests the equivalent template literal.
-  - Auto-fix produces the correct `` `string ${variable}` `` replacement.
-  - Pure string literal chains (`"a" + "b"`) and numeric addition are not flagged.
-  - Closes P2 quality FN `prob_string_concat` in the ILB-Arena-Quality bench.
-
-  **New rule: `modularity/no-mutable-exports`**
-  - Flags `export let` and `export var` — module exports should be immutable `const`
-    bindings so all importers share a stable reference.
-  - Auto-fix replaces `let`/`var` with `const`.
-  - Closes P2 quality FN `prob_mutable_export` in the ILB-Arena-Quality bench.
-
-- Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
-  - @interlace/eslint-devkit@1.4.1
-
-### Added
-
-- New rule `no-deprecated-buffer` — flags use of the deprecated `Buffer()` constructor (Node.js security advisory; `Buffer.from`/`Buffer.alloc` should be used instead). Enabled in the `recommended` preset at `warn` to avoid breaking adopters with legacy `Buffer()` calls; will be promoted to `error` in the next major.
-
-### Bug Fixes
-
-- `no-zip-slip`: removed redundant dangerous-destination check from the literal handler. Extraction-call handler already reports `dangerousArchiveDestination`; the literal-side check was producing duplicate errors and (separately) firing on unrelated calls like `fs.readFileSync('/etc/app/config')`.
-- `lock-file`, `detect-child-process`: minor refinements (see source diff).
-
-## [4.0.4] - 2026-02-08
-
-### Bug Fixes
-
-- align codecov component IDs with full package names ([2831b968](https://github.com/ofri-peretz/eslint/commit/2831b968))
-- resolve all benchmark FN/FP across security rules ([45ffb791](https://github.com/ofri-peretz/eslint/commit/45ffb791))
-- **rules:** reduce false positives across security rules ([c192233c](https://github.com/ofri-peretz/eslint/commit/c192233c))
-
-### Documentation
-
-- fix changelog header format across all packages ([c3a15082](https://github.com/ofri-peretz/eslint/commit/c3a15082))
-
-### ❤️ Thank You
-
-- Ofri Peretz
-
-## [4.0.3] - 2026-02-06
-
-### Bug Fixes
-
-- ⚠️ **rules:** reduce false positives across security rules ([af4ca0e7](https://github.com/ofri-peretz/eslint/commit/af4ca0e7))
-- align codecov component names and update docs components ([0a59a86c](https://github.com/ofri-peretz/eslint/commit/0a59a86c))
-
-### ⚠️ Breaking Changes
-
-- **rules:** Some previously flagged patterns are now correctly allowed ([af4ca0e7](https://github.com/ofri-peretz/eslint/commit/af4ca0e7))
-
-### ❤️ Thank You
-
-- Ofri Peretz
-
-## [4.0.2] - 2026-02-02
-
-This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
-
-# Changelog
-
-All notable changes to `eslint-plugin-node-security` will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-### Documentation
-
-- 📘 Launched new documentation site: [eslint.interlace.tools](https://eslint.interlace.tools/)
-- 📝 Achieved 100% documentation parity (both .md and .mdx files)
-
-## [4.0.1] - 2026-02-02
-
-This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
-
-## [4.0.0] - 2026-02-02
-
-This was a version bump only for eslint-plugin-node-security to align it with other projects, there were no code changes.
-
-## [1.0.0] - 2026-01-26
-
-### Added
-
-- Initial stable release with 31 Node.js security rules
-- LLM-optimized error messages with CWE references and OWASP mapping
-- 100% test coverage across all rules
-- ESLint 8 and ESLint 9 flat config support
-- TypeScript type definitions for all rule options
-
-### Rule Categories
-
-#### Cryptography Rules (12)
-
-- `no-sha1-hash` - Disallow SHA-1 for security-sensitive operations (CWE-328)
-- `no-weak-hash-algorithm` - Disallow MD5, SHA-1 for cryptographic hashing (CWE-328)
-- `no-ecb-mode` - Disallow ECB mode for block ciphers (CWE-327)
-- `no-static-iv` - Disallow static initialization vectors (CWE-329)
-- `no-insecure-key-derivation` - Require secure key derivation functions (CWE-916)
-- `no-insecure-rsa-padding` - Require OAEP padding for RSA (CWE-780)
-- `no-self-signed-certs` - Detect disabled TLS certificate validation (CWE-295)
-- `no-timing-unsafe-compare` - Require timing-safe comparison for secrets (CWE-208)
-- `no-cryptojs` - Prefer native crypto over CryptoJS (CWE-327)
-- `no-cryptojs-weak-random` - Disallow CryptoJS weak random (CWE-338)
-- `no-deprecated-cipher-method` - Disallow deprecated crypto methods (CWE-327)
-- `prefer-native-crypto` - Prefer Node.js native crypto module
-
-#### File System Rules (7)
-
-- `no-path-traversal` - Prevent path traversal attacks (CWE-22)
-- `no-unsafe-file-permissions` - Enforce secure file permissions (CWE-732)
-- `no-symlink-attacks` - Prevent symlink-based attacks (CWE-59)
-- `require-file-validation` - Require file type validation (CWE-434)
-- `no-temp-file-exposure` - Prevent temp file security issues (CWE-377)
-- `no-hardcoded-paths` - Prevent hardcoded sensitive paths (CWE-426)
-- `require-safe-path-join` - Require path.join for path construction (CWE-22)
-
-#### Process & Shell Rules (6)
-
-- `no-child-process-injection` - Prevent command injection (CWE-78)
-- `no-shell-exec` - Disallow shell: true in spawn options (CWE-78)
-- `no-env-exposure` - Prevent environment variable exposure (CWE-214)
-- `require-process-sanitization` - Require input sanitization for process args (CWE-88)
-- `no-unsafe-exec` - Disallow exec with dynamic input (CWE-78)
-- `no-eval-alternatives` - Disallow Function constructor, vm runInContext (CWE-95)
-
-#### Network Rules (6)
-
-- `require-tls-verification` - Require TLS certificate validation (CWE-295)
-- `no-dns-rebinding` - Prevent DNS rebinding attacks (CWE-350)
-- `no-ssrf` - Prevent Server-Side Request Forgery (CWE-918)
-- `require-https` - Require HTTPS for external requests (CWE-319)
-- `no-unsafe-redirect` - Prevent open redirects (CWE-601)
-- `require-host-validation` - Require host header validation (CWE-20)
-
-### Presets
-
-- `recommended` - Balanced security for Node.js applications
-- `strict` - All rules as errors
-- `crypto` - Cryptography-focused subset
-- `filesystem` - File system security subset
-- `network` - Network security subset
-
-### Features
-
-- Comprehensive detection patterns for Node.js core modules
-- Support for popular libraries (fs-extra, glob, rimraf)
-- Auto-fix capabilities where safe
-- ESLint MCP integration for AI assistants

package/src/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,uEAAkE;AAClE,qFAA+E;AAC/E,2FAAoF;AACpF,iFAA2E;AAC3E,mEAA8D;AAC9D,uEAAkE;AAClE,6EAAwE;AACxE,qDAAgD;AAChD,+EAAyE;AACzE,6EAAsE;AACtE,6CAAyC;AACzC,mEAA8D;AAC9D,2FAAqF;AAErF,oCAAoC;AACpC,2FAAsF;AACtF,iDAA6C;AAC7C,yFAAmF;AACnF,uFAAkF;AAClF,iGAA2F;AAC3F,6EAAwE;AACxE,mFAA8E;AAC9E,mEAA8D;AAE9D,6BAA6B;AAC7B,qDAAiD;AACjD,6EAAuE;AACvE,qFAA+E;AAC/E,qDAAgD;AAChD,mFAA6E;AAC7E,yEAAmE;AACnE,6EAAuE;AACvE,uEAAiE;AACjE,uDAAkD;AAClD,uDAAkD;AAClD,+EAAyE;AACzE,+EAAyE;AACzE,2EAAqE;AACrE,uEAAkE;AAIrD,QAAA,KAAK,GAGd;IACF,sBAAsB,EAAE,yCAAkB;IAC1C,6BAA6B,EAAE,sDAAwB;IACvD,gCAAgC,EAAE,2DAA0B;IAC5D,2BAA2B,EAAE,kDAAsB;IACnD,oBAAoB,EAAE,qCAAgB;IACtC,sBAAsB,EAAE,yCAAkB;IAC1C,yBAAyB,EAAE,+CAAqB;IAChD,aAAa,EAAE,uBAAS;IACxB,0BAA0B,EAAE,gDAAqB;IACjD,yBAAyB,EAAE,6CAAmB;IAC9C,SAAS,EAAE,gBAAM;IACjB,oBAAoB,EAAE,qCAAgB;IACtC,gCAAgC,EAAE,4DAA2B;IAE7D,iBAAiB;IACjB,gCAAgC,EAAE,6DAA4B;IAC9D,WAAW,EAAE,oBAAQ;IACrB,+BAA+B,EAAE,0DAA0B;IAC3D,8BAA8B,EAAE,yDAA0B;IAC1D,mCAAmC,EAAE,kEAA8B;IACnE,yBAAyB,EAAE,+CAAqB;IAChD,4BAA4B,EAAE,qDAAwB;IACtD,oBAAoB,EAAE,qCAAgB;IAEtC,wBAAwB;IACxB,aAAa,EAAE,wBAAU;IACzB,yBAAyB,EAAE,8CAAoB;IAC/C,6BAA6B,EAAE,sDAAwB;IACvD,aAAa,EAAE,uBAAS;IACxB,4BAA4B,EAAE,oDAAuB;IACrD,yBAAyB,EAAE,8CAAoB;IAC/C,uBAAuB,EAAE,0CAAkB;IAC3C,sBAAsB,EAAE,wCAAiB;IACzC,cAAc,EAAE,yBAAU;IAC1B,cAAc,EAAE,yBAAU;IAC1B,0BAA0B,EAAE,gDAAqB;IACjD,0BAA0B,EAAE,gDAAqB;IACjD,wBAAwB,EAAE,4CAAmB;IAC7C,sBAAsB,EAAE,yCAAkB;CAC3C,CAAC;AAEW,QAAA,MAAM,GAA+B;IAChD,IAAI,EAAE;QACJ,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,OAAO;KACjB;IACD,KAAK,EAAL,aAAK;CACN,CAAC;AAEF,MAAM,gBAAgB,GAAkD;IACtE,oCAAoC,EAAE,OAAO;IAC7C,2CAA2C,EAAE,OAAO;IACpD,8CAA8C,EAAE,OAAO;IACvD,yCAAyC,EAAE,OAAO;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,kCAAkC,EAAE,MAAM;IAC1C,mEAAmE;IACnE,wEAAwE;IACxE,6CAA6C;IAC7C,oCAAoC,EAAE,OAAO;IAC7C,uCAAuC,EAAE,OAAO;IAChD,2BAA2B,EAAE,OAAO;IACpC,wCAAwC,EAAE,OAAO;IACjD,uCAAuC,EAAE,OAAO;IAChD,uBAAuB,EAAE,MAAM;IAC/B,kCAAkC,EAAE,OAAO;IAC3C,8CAA8C,EAAE,OAAO;IACvD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAC9D,0EAA0E;IAC1E,iEAAiE;IACjE,wCAAwC,EAAE,MAAM;IAEhD,iBAAiB;IACjB,8CAA8C,EAAE,MAAM;IACtD,yBAAyB,EAAE,MAAM,EAAE,2DAA2D;IAC9F,4CAA4C,EAAE,OAAO;IAErD,8BAA8B;IAC9B,sCAAsC,EAAE,OAAO;IAC/C,wCAAwC,EAAE,OAAO;IACjD,4BAA4B,EAAE,OAAO;IACrC,2BAA2B,EAAE,OAAO;IACpC,qCAAqC,EAAE,OAAO;IAC9C,2BAA2B,EAAE,OAAO;CACrC,CAAC;AAEW,QAAA,OAAO,GAA+C;IACjE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,gBAAgB;KACa;IACtC,MAAM,EAAE;QACN,OAAO,EAAE;YACP,eAAe,EAAE,cAAM;SACxB;QACD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,aAAK,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnC,iBAAiB,QAAQ,EAAE;YAC3B,OAAO;SACR,CAAC,CACH;KACmC;CACvC,CAAC;AAEF,kBAAe,cAAM,CAAC"}

package/src/oxlint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oxlint.js","sourceRoot":"","sources":["../../src/oxlint.ts"],"names":[],"mappings":";AAAA;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AAEH,mCAAiC;AAEjC,iBAAS,cAAM,CAAC"}

package/src/rules/detect-child-process/index.d.ts

@@ -1,52 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: detect-child-process
- * Detects instances of child_process & non-literal exec() calls
- * LLM-optimized with comprehensive command injection prevention guidance
- *
- * @see https://owasp.org/www-community/attacks/Command_Injection
- * @see https://cwe.mitre.org/data/definitions/78.html
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-type MessageIds = 'childProcessCommandInjection' | 'useExecFile' | 'useSpawn' | 'useSaferLibrary' | 'validateInput' | 'useShellFalse' | 'strategyValidate' | 'strategySanitize' | 'strategyRestrict';
-export interface Options {
-    /** Allow exec() with literal strings. Default: false (stricter) */
-    allowLiteralStrings?: boolean;
-    /** Allow spawn() with literal arguments. Default: false (stricter) */
-    allowLiteralSpawn?: boolean;
-    /** Additional child_process methods to check */
-    additionalMethods?: string[];
-    /** Strategy for fixing command injection: 'validate', 'sanitize', 'restrict', or 'auto' */
-    strategy?: 'validate' | 'sanitize' | 'restrict' | 'auto';
-}
-type RuleOptions = [Options?];
-/**
- * Command execution patterns and their security implications
- */
-interface CommandPattern {
-    method: string;
-    dangerous: boolean;
-    vulnerability: 'command-injection' | 'argument-injection' | 'path-injection';
-    safeAlternatives: string[];
-    example: {
-        bad: string;
-        good: string[];
-    };
-    effort: string;
-}
-/**
- * Generate refactoring steps based on the pattern.
- *
- * Module-scope (rather than inline in `create()`) so the `default` branch —
- * unreachable through COMMAND_PATTERNS, which only contains methods with
- * dedicated cases — is directly unit-testable.
- */
-export declare const generateRefactoringSteps: (pattern: CommandPattern) => string;
-export type { CommandPattern };
-export declare const detectChildProcess: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};

package/src/rules/detect-child-process/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/detect-child-process/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAA0F;AAC1F,4DAAsD;AAyCtD,MAAM,gBAAgB,GAAqB;IACzC;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;QACvC,OAAO,EAAE;YACP,uDAAuD;YACvD,GAAG,EAAE,8BAA8B;YACnC,IAAI,EAAE;gBACJ,yDAAyD;gBACzD,sDAAsD;aACvD;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;QAC/C,uDAAuD;QACvD,OAAO,EAAE;YACP,uDAAuD;YACvD,GAAG,EAAE,wCAAwC;YAC7C,IAAI,EAAE;gBACJ,mEAAmE;gBACnE,gEAAgE;aACjE;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,oBAAoB;QACnC,gBAAgB,EAAE,CAAC,uBAAuB,CAAC;QAC3C,OAAO,EAAE;YACP,GAAG,EAAE,wCAAwC;YAC7C,IAAI,EAAE;gBACJ,wDAAwD;gBACxD,oCAAoC;aACrC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,2CAA2C;YAChD,IAAI,EAAE;gBACJ,wDAAwD;gBACxD,oCAAoC;aACrC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,WAAW,CAAC;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,qCAAqC;YAC1C,IAAI,EAAE;gBACJ,4DAA4D;gBAC5D,oCAAoC;aACrC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,oBAAoB;QACnC,gBAAgB,EAAE,CAAC,2BAA2B,CAAC;QAC/C,OAAO,EAAE;YACP,GAAG,EAAE,4CAA4C;YACjD,IAAI,EAAE;gBACJ,4DAA4D;gBAC5D,oCAAoC;aACrC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,kBAAkB;YACvB,IAAI,EAAE;gBACJ,oDAAoD;gBACpD,+BAA+B;aAChC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;IACD;QACE,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,mBAAmB;QAClC,gBAAgB,EAAE,CAAC,WAAW,CAAC;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,sBAAsB;YAC3B,IAAI,EAAE;gBACJ,4EAA4E;gBAC5E,+BAA+B;aAChC;SACF;QACD,MAAM,EAAE,eAAe;KACxB;CACF,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,wBAAwB,GAAG,CAAC,OAAuB,EAAU,EAAE;IAC1E,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACb,OAAO;gBACL,iDAAiD;gBACjD,gEAAgE;gBAChE,iEAAiE;gBACjE,6CAA6C;gBAC7C,wDAAwD;aACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,OAAO;YACV,OAAO;gBACL,+DAA+D;gBAC/D,iDAAiD;gBACjD,qDAAqD;gBACrD,iDAAiD;gBACjD,4DAA4D;aAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,UAAU;YACb,OAAO;gBACL,2DAA2D;gBAC3D,8CAA8C;gBAC9C,+CAA+C;gBAC/C,iCAAiC;gBACjC,oCAAoC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,cAAc;YACjB,OAAO;gBACL,mEAAmE;gBACnE,8CAA8C;gBAC9C,+CAA+C;gBAC/C,iCAAiC;gBACjC,oCAAoC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,WAAW;YACd,OAAO;gBACL,+DAA+D;gBAC/D,iDAAiD;gBACjD,qDAAqD;gBACrD,iDAAiD;gBACjD,6CAA6C;aAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,MAAM;YACT,OAAO;gBACL,uDAAuD;gBACvD,mDAAmD;gBACnD,0DAA0D;gBAC1D,iCAAiC;gBACjC,kEAAkE;aACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,UAAU;YACb,OAAO;gBACL,+DAA+D;gBAC/D,mDAAmD;gBACnD,8DAA8D;gBAC9D,yDAAyD;gBACzD,sEAAsE;aACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf;YACE,OAAO;gBACL,oDAAoD;gBACpD,+CAA+C;gBAC/C,2DAA2D;gBAC3D,0CAA0C;gBAC1C,kCAAkC;aACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;AA3EW,QAAA,wBAAwB,4BA2EnC;AAIW,QAAA,kBAAkB,GAAG,IAAA,0BAAU,EAA0B;IACpE,IAAI,EAAE,sBAAsB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,yHAAyH;YAC9H,WAAW,EAAE,8DAA8D;YAC3E,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,QAAQ;SACrB;QACD,QAAQ,EAAE;YACR,8EAA8E;YAC9E,4BAA4B,EAAE,IAAA,gCAAgB,EAAC;gBAC7C,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,mBAAmB;gBAC9B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4BAA4B;gBACzC,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,oCAAoC;gBACjD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,2FAA2F;aAC/G,CAAC;YACF,QAAQ,EAAE,IAAA,gCAAgB,EAAC;gBACzB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,WAAW;gBACtB,WAAW,EAAE,qCAAqC;gBAClD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,4CAA4C;gBACjD,iBAAiB,EAAE,kFAAkF;aACtG,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uCAAuC;gBAC5C,iBAAiB,EAAE,uCAAuC;aAC3D,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,eAAe;gBAC1B,WAAW,EAAE,yBAAyB;gBACtC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,sCAAsC;gBACnD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,wCAAwC;gBAC7C,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,mCAAmC;qBACjD;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,sCAAsC;qBACpD;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,2CAA2C;qBACzD;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;wBAClD,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,gEAAgE;qBAC9E;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,mBAAmB,EAAE,KAAK;YAC1B,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,EAAE;YACrB,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,mBAAmB,GAAG,KAAK,EAC3B,iBAAiB,GAAG,KAAK,EACzB,iBAAiB,GAAG,EAAE,GACvB,GAAY,OAAO,CAAC;QAErB;;WAEG;QACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;YAClC,MAAM;YACN,UAAU;YACV,UAAU;YACV,cAAc;YACd,OAAO;YACP,WAAW;YACX,MAAM;YACN,UAAU;YACV,GAAG,iBAAiB;SACrB,CAAC,CAAC;QAEH;;;WAGG;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAE1C;;WAEG;QACH,uDAAuD;QACvD,MAAM,sBAAsB,GAAG,CAAC,IAAmB,EAAW,EAAE;YAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAAqB,EAAW,EAAE;YAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEpC,wDAAwD;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAQ,OAA4B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAC;YACf,CAAC;YAED,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACzC,MAAM,kBAAkB,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAwB,EAAE,EAAE,CAC/E,EAAE,EAAE,IAAI,KAAK,SAAS,IAAI,OAAQ,EAAuB,CAAC,KAAK,KAAK,QAAQ,CAC7E,CAAC;oBACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;wBACxB,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;qBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxC,sDAAsD;oBACtD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,2EAA2E;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAAW,EAAE;YACrE,sEAAsE;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;gBACvE,8CAA8C;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,QAAQ;oBACrC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC9B,uBAAuB;oBACvB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBAC7E,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,4CAA4C;oBAC5C,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,8CAA8C;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;WAGG;QACH,MAAM,+BAA+B,GAAG,CAAC,IAA6B,EAAW,EAAE;YACjF,6DAA6D;YAC7D,MAAM,cAAc,GAAG,CAAC,iBAA8B,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,CAAC,OAAsB,EAAW,EAAE;oBAChD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACtF,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBACvC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBACjG,CAAC;oBACD,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,EAAE,CAAC;wBACpD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC/D,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,+EAA+E;YAC/E,MAAM,gBAAgB,GAAG,CAAC,MAA4B,EAAW,EAAE;gBACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBAEzB,uEAAuE;gBACvE,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;oBAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACrC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;4BAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzE,CAAC;oBACD,MAAM,KAAK,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;oBAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,IAAI,KAAK,CAAC,GAAG,CAAC;4BAAE,OAAO,IAAI,CAAC;oBAC9B,CAAC;gBACH,CAAC;gBAED,yEAAyE;gBACzE,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;oBACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;oBACpD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC7D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACtD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;oBACrC,MAAM,WAAW,GAAG,CAClB,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;wBAClD,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;wBACjD,CAAC,UAAU,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;4BACjD,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;4BAC1B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;gCAC1D,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,CAAC,CAAC,CAC9D,CAAC;oBACF,IAAI,WAAW,EAAE,CAAC;wBAChB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;wBAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;4BAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;gCAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACzE,CAAC;wBACD,MAAM,KAAK,GAAG,cAAc,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC9F,sFAAsF;wBACtF,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gCACjC,IAAI,KAAK,CAAC,GAAG,CAAC;oCAAE,OAAO,IAAI,CAAC;4BAC9B,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,0DAA0D;4BAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gCACjC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;oCACzB,CAAC,GAAG,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,EAAE,CAAC;oCACxG,OAAO,IAAI,CAAC;gCACd,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,iEAAiE;YACjE,IAAI,OAAO,GAA8B,IAAI,CAAC,MAAM,CAAC;YACrD,OAAO,OAAO,EAAE,CAAC;gBACf,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACnC,IAAI,gBAAgB,CAAC,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC7C,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,CAAC;YAED,qFAAqF;YACrF,6FAA6F;YAC7F,IAAI,IAAI,GAA8B,IAAI,CAAC,MAAM,CAAC;YAClD,kEAAkE;YAClE,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBACjF,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;YACD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAiC,CAAC;gBACrD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAA0B,CAAC,CAAC;gBACjE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,yDAAyD;oBACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;4BACnC,IAAI,gBAAgB,CAAC,OAAO,CAAC;gCAAE,OAAO,IAAI,CAAC;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAE,MAAc,EAIvE,EAAE;YACF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE5F,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;YAExE,6CAA6C;YAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;YAE3F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtC,CAAC,CAAC;QAEF;;WAEG;QACH,uDAAuD;QACvD,MAAM,kBAAkB,GAAG,CAAC,OAA8B,EAAE,SAAkB,EAAkC,EAAE;YAChH,IAAI,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;gBACpC,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,IAAI,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAC1B,IAA6B,EACyB,EAAE;YACxD,0BAA0B;YAC1B,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAC1C,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,6CAA6C;gBAC7C,IACE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAC1C,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnF,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,qBAAqB,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;YAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAEtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,qEAAqE;YACrE,oCAAoC;YACpC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrG,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,+CAA+C;YAC/C,IAAI,mBAAmB,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,0EAA0E;YAC1E,kDAAkD;YAClD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YACjF,IAAI,iBAAiB,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,6EAA6E;YAC7E,mFAAmF;YACnF,gEAAgE;YAChE,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnE,MAAM,UAAU,GAAG,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,cAAc,CAAC;gBACtE,IAAI,UAAU,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5C,OAAO;gBACT,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1E,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,4BAA4B;YAC5B,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gCAAwB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC;YAClG,MAAM,YAAY,GAAG,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iCAAiC,CAAC;YAE/F,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,8BAA8B;gBACzC,IAAI,EAAE;oBACJ,MAAM;oBACN,IAAI;oBACJ,SAAS;oBACT,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB;oBAC5D,YAAY;oBACZ,KAAK;oBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,eAAe;iBAC3C;gBACD,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,aAAa;wBACxB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,UAAU;wBACrB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,uBAAuB,GAAG,CAAC,IAAgC,EAAE,EAAE;YACnE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IAAI,SAAS,CAAC,IAAI,KAAK,wBAAwB,IAAI,SAAS,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;oBACjG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAED,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACzC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,wBAAwB,GAAG,CAAC,IAAiC,EAAE,EAAE;YACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,uCAAuC;YACvC,IACE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY;gBAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBACnC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,EAChD,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,6CAA6C;YAC7C,IACE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe;gBAChC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,gBAAgB;gBACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;gBACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,EAChD,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;oBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC/D,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,qBAAqB;YACrC,iBAAiB,EAAE,uBAAuB;YAC1C,kBAAkB,EAAE,wBAAwB;SAC7C,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/detect-eval-with-expression/index.d.ts

@@ -1,46 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: detect-eval-with-expression
- * Detects eval(variable) which can allow an attacker to run arbitrary code
- * LLM-optimized with comprehensive fix guidance and security context
- *
- * @see https://owasp.org/www-community/attacks/Code_Injection
- * @see https://cwe.mitre.org/data/definitions/95.html
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-type MessageIds = 'evalWithExpression' | 'useJsonParse' | 'useObjectAccess' | 'useTemplateLiteral' | 'useFunctionConstructor' | 'useSaferAlternative' | 'strategyRemove' | 'strategyRefactor' | 'strategyValidate';
-export interface Options {
-    /** Allow eval with literal strings. Default: false (stricter) */
-    allowLiteralStrings?: boolean;
-    /** Additional functions to treat as eval-like */
-    additionalEvalFunctions?: string[];
-    /** Strategy for fixing eval usage: 'remove', 'refactor', 'validate', or 'auto' */
-    strategy?: 'remove' | 'refactor' | 'validate' | 'auto';
-}
-type RuleOptions = [Options?];
-/**
- * Pattern categories and their safe alternatives
- */
-interface EvalPattern {
-    pattern: string;
-    category: 'json' | 'math' | 'template' | 'object' | 'dynamic' | 'other';
-    safeAlternative: string;
-    example: {
-        bad: string;
-        good: string;
-    };
-    effort: string;
-}
-/**
- * Generate refactoring steps based on pattern.
- * Module-scope so it is directly unit-testable (Layer-2).
- */
-export declare const generateRefactoringSteps: (pattern: EvalPattern | null) => string;
-export declare const detectEvalWithExpression: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export {};

package/src/rules/detect-eval-with-expression/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rules/detect-eval-with-expression/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAWH,4DAA0E;AAC1E,4DAAsD;AAqCtD,MAAM,aAAa,GAAkB;IACnC;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,cAAc;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,6CAA6C;SACpD;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,uCAAuC;QACxD,OAAO,EAAE;YACP,GAAG,EAAE,gDAAgD;YACrD,IAAI,EAAE,8EAA8E;SACrF;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,sCAAsC;QACvD,OAAO,EAAE;YACP,GAAG,EAAE,qCAAqC;YAC1C,uDAAuD;YACvD,IAAI,EAAE,wCAAwC;SAC/C;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,+BAA+B;QAChD,OAAO,EAAE;YACP,GAAG,EAAE,2BAA2B;YAChC,IAAI,EAAE,yFAAyF;SAChG;QACD,MAAM,EAAE,WAAW;KACpB;CACF,CAAC;AAEF;;;GAGG;AACI,MAAM,wBAAwB,GAAG,CAAC,OAA2B,EAAU,EAAE;IAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,oCAAoC;YACpC,mDAAmD;YACnD,gEAAgE;YAChE,uDAAuD;YACvD,sCAAsC;SACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO;gBACL,wCAAwC;gBACxC,yCAAyC;gBACzC,6CAA6C;gBAC7C,8CAA8C;aAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,MAAM;YACT,OAAO;gBACL,kDAAkD;gBAClD,8CAA8C;gBAC9C,mCAAmC;gBACnC,uDAAuD;aACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,uDAAuD;QACvD,KAAK,UAAU;YACb,OAAO;gBACL,uDAAuD;gBACvD,8CAA8C;gBAC9C,+CAA+C;gBAC/C,wDAAwD;gBACxD,mCAAmC;aACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf,KAAK,QAAQ;YACX,OAAO;gBACL,oDAAoD;gBACpD,wCAAwC;gBACxC,kCAAkC;gBAClC,sDAAsD;aACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEf;YACE,OAAO;gBACL,sCAAsC;gBACtC,yCAAyC;gBACzC,0CAA0C;gBAC1C,uCAAuC;aACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;AAtDW,QAAA,wBAAwB,4BAsDnC;AAEW,QAAA,wBAAwB,GAAG,IAAA,0BAAU,EAA0B;IAC1E,IAAI,EAAE,6BAA6B;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,GAAG,EAAE,gIAAgI;YACrI,WAAW,EAAE,0EAA0E;YACvF,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,GAAG;YACT,UAAU,EAAE,MAAM;SACnB;QACD,QAAQ,EAAE;YACR,4FAA4F;YAC5F,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0BAA0B;gBACvC,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mCAAmC;gBAC9C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0EAA0E;gBACvF,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,kEAAkE;gBAC/E,uDAAuD;gBACvD,QAAQ,EAAE,MAAM;gBAChB,uDAAuD;gBACvD,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iBAAiB;gBACtB,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;oBACD,uBAAuB,EAAE;wBACvB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,4CAA4C;qBAC1D;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;wBAChD,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,yDAAyD;qBACvE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,mBAAmB,EAAE,KAAK;YAC1B,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,mBAAmB,GAAG,KAAK,EAC3B,uBAAuB,GAAG,EAAE,EAC5B,QAAQ,GAAG,MAAM,EAClB,GAAY,OAAO,CAAC;QAErB;;;WAGG;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;YAC5B,MAAM;YACN,UAAU;YACV,GAAG,uBAAuB;SAC3B,CAAC,CAAC;QAEH;;WAEG;QACH,uDAAuD;QACvD,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,qBAAqB,GAAG,CAAC,OAA2B,EAAc,EAAE;YACxE,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,QAAQ;oBACX,OAAO,gBAAgB,CAAC;gBAC1B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,MAAM,CAAC;gBACZ;oBACE,gDAAgD;oBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;wBAC3C,OAAO,cAAc,CAAC;oBACxB,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC7C,OAAO,iBAAiB,CAAC;oBAC3B,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;wBAC/C,OAAO,oBAAoB,CAAC;oBAC9B,CAAC;oBACD,OAAO,kBAAkB,CAAC,CAAC,2CAA2C;YAC1E,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAsB,EAAE;YAC/D,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtD,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,iBAAiB,GAAG,CAAC,IAA6B,EAAU,EAAE;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAEtC,+BAA+B;YAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC5D,gDAAgD;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACjC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAExC,yDAAyD;gBACzD,IAAI,mBAAmB;oBACnB,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;oBAC3B,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,IAAA,gCAAwB,EAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU;wBACV,eAAe,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB;wBAC9D,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,sBAAsB;wBACnE,KAAK;wBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,eAAe;qBAC3C;oBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjB;4BACE,SAAS,EAAE,iBAAiB;4BAC5B,IAAI,EAAE;gCACJ,eAAe,EAAE,OAAO,CAAC,eAAe;gCACxC,WAAW,EAAE,OAAO,CAAC,eAAe;6BACrC;4BACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,8CAA8C;yBAC/D;qBACF,CAAC,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAE3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAA4B,EAAE,EAAE;YAC1D,iCAAiC;YACjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClG,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,mBAAmB;YACnC,aAAa,EAAE,kBAAkB;SAClC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/detect-non-literal-fs-filename/index.d.ts

@@ -1,52 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: detect-non-literal-fs-filename
- * Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system
- * LLM-optimized with comprehensive path traversal prevention guidance
- *
- * @see https://owasp.org/www-community/attacks/Path_Traversal
- * @see https://cwe.mitre.org/data/definitions/22.html
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-type MessageIds = 'fsPathTraversal' | 'usePathResolve' | 'validatePath' | 'useBasename' | 'createSafeDir' | 'whitelistExtensions';
-export interface Options {
-    /** Allow literal strings. Default: false (stricter) */
-    allowLiterals?: boolean;
-    /** Additional fs methods to check */
-    additionalMethods?: string[];
-}
-type RuleOptions = [Options?];
-/**
- * File system operations and their security implications
- */
-interface FSOperation {
-    method: string;
-    dangerous: boolean;
-    vulnerability: 'path-traversal' | 'directory-traversal' | 'file-access';
-    safePattern: string;
-    example: {
-        bad: string;
-        good: string;
-    };
-    effort: string;
-}
-/**
- * Generate refactoring steps based on the operation.
- * Module-scope so the default arm (methods without a dedicated entry) is
- * directly unit-testable (Layer-2).
- */
-export declare const generateRefactoringSteps: (operation: FSOperation) => string;
-/**
- * Determine risk level based on the operation and path.
- * Module-scope so the non-dangerous fallback (no FS_OPERATIONS entry sets
- * dangerous: false today) is directly unit-testable (Layer-2).
- */
-export declare const determineRiskLevel: (operation: FSOperation, pathStr: string) => string;
-export declare const detectNonLiteralFsFilename: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export {};