eslint-plugin-node-security 4.6.0 → 4.7.0

package/README.md

@@ -93,6 +93,7 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
 | [no-data-in-temp-storage](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-data-in-temp-storage?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-312 |  |  | Temporary directories (/tmp, /var/tmp, temp/) are often world-readable or persist longer than expected | 🟢 |  |  |  |  |  |
 | [no-deprecated-buffer](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-buffer?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-676 |  |  | Disallow the deprecated `new Buffer()` constructor and `Buffer()` factory call. | 🟢 |  |  |  | 💡 |  |
 | [no-deprecated-cipher-method](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-deprecated-cipher-method?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow deprecated crypto.createCipher/createDecipher methods | 🟢 |  |  |  |  |  |
+| [no-dynamic-command-string](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-command-string?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-77 | A03:2021 |  | Detects dynamically assembled command strings handed to a shell flag (bash -c) or to a command-runner that… | 🟢 |  |  |  |  |  |
 | [no-dynamic-dependency-loading](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-1104 |  |  | This rule detects dynamically constructed paths in require() and import() statements | 🟢 |  |  |  |  |  |
 | [no-dynamic-require](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-dynamic-require?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) |  |  |  | Forbid require() calls with non-literal arguments | 🟢 |  |  |  |  |  |
 | [no-ecb-mode](https://eslint.interlace.tools/docs/security/plugin-node-security/rules/no-ecb-mode?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security) | CWE-327 | A02:2021 |  | Disallow ECB encryption mode (use GCM or CBC instead) | 🟢 |  |  |  |  |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -24,7 +24,7 @@
   "homepage": "https://eslint.interlace.tools/docs/security/plugin-node-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-node-security",
   "repository": {
     "type": "git",
-    "url": "https://github.com/ofri-peretz/eslint",
+    "url": "git+https://github.com/ofri-peretz/eslint.git",
     "directory": "packages/eslint-plugin-node-security"
   },
   "bugs": {
@@ -35,11 +35,8 @@
   },
   "files": [
     "src/",
-    "dist/",
     "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "AGENTS.md"
+    "LICENSE"
   ],
   "keywords": [
     "eslint",
@@ -82,7 +79,7 @@
   },
   "dependencies": {
     "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.4"
+    "@interlace/eslint-devkit": "^1.6.0"
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.46.2",
@@ -99,6 +96,6 @@
   },
   "funding": {
     "type": "github",
-    "url": "https://github.com/ofri-peretz/eslint"
+    "url": "git+https://github.com/ofri-peretz/eslint.git"
   }
 }

package/src/index.d.ts

@@ -1,10 +1,17 @@
-/**
- * eslint-plugin-node-security
- *
- * Security rules for Node.js built-in modules (fs, child_process, vm, path, etc.)
- */
-import { TSESLint } from '@interlace/eslint-devkit';
-export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
-export declare const plugin: TSESLint.FlatConfig.Plugin;
-export declare const configs: Record<string, TSESLint.FlatConfig.Config>;
-export default plugin;
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/src/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * eslint-plugin-node-security
- *
- * Security rules for Node.js built-in modules (fs, child_process, vm, path, etc.)
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configs = exports.plugin = exports.rules = void 0;
 const detect_child_process_1 = require("./rules/detect-child-process");
@@ -19,8 +14,8 @@ const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
 const no_data_in_temp_storage_1 = require("./rules/no-data-in-temp-storage");
 const no_ssrf_1 = require("./rules/no-ssrf");
 const no_shell_injection_1 = require("./rules/no-shell-injection");
+const no_dynamic_command_string_1 = require("./rules/no-dynamic-command-string");
 const no_dynamic_algorithm_selection_1 = require("./rules/no-dynamic-algorithm-selection");
-// Migrated rules from secure-coding
 const detect_suspicious_dependencies_1 = require("./rules/detect-suspicious-dependencies");
 const lock_file_1 = require("./rules/lock-file");
 const no_dynamic_dependency_loading_1 = require("./rules/no-dynamic-dependency-loading");
@@ -29,7 +24,6 @@ const require_secure_credential_storage_1 = require("./rules/require-secure-cred
 const require_secure_deletion_1 = require("./rules/require-secure-deletion");
 const require_storage_encryption_1 = require("./rules/require-storage-encryption");
 const no_dynamic_require_1 = require("./rules/no-dynamic-require");
-// Migrated rules from crypto
 const no_cryptojs_1 = require("./rules/no-cryptojs");
 const no_cryptojs_weak_random_1 = require("./rules/no-cryptojs-weak-random");
 const no_deprecated_cipher_method_1 = require("./rules/no-deprecated-cipher-method");
@@ -58,8 +52,8 @@ exports.rules = {
     'no-data-in-temp-storage': no_data_in_temp_storage_1.noDataInTempStorage,
     'no-ssrf': no_ssrf_1.noSsrf,
     'no-shell-injection': no_shell_injection_1.noShellInjection,
+    'no-dynamic-command-string': no_dynamic_command_string_1.noDynamicCommandString,
     'no-dynamic-algorithm-selection': no_dynamic_algorithm_selection_1.noDynamicAlgorithmSelection,
-    // Migrated rules
     'detect-suspicious-dependencies': detect_suspicious_dependencies_1.detectSuspiciousDependencies,
     'lock-file': lock_file_1.lockFile,
     'no-dynamic-dependency-loading': no_dynamic_dependency_loading_1.noDynamicDependencyLoading,
@@ -68,7 +62,6 @@ exports.rules = {
     'require-secure-deletion': require_secure_deletion_1.requireSecureDeletion,
     'require-storage-encryption': require_storage_encryption_1.requireStorageEncryption,
     'no-dynamic-require': no_dynamic_require_1.noDynamicRequire,
-    // Migrated crypto rules
     'no-cryptojs': no_cryptojs_1.noCryptojs,
     'no-cryptojs-weak-random': no_cryptojs_weak_random_1.noCryptojsWeakRandom,
     'no-deprecated-cipher-method': no_deprecated_cipher_method_1.noDeprecatedCipherMethod,
@@ -87,7 +80,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.6.0',
+        version: '4.7.0',
     },
     rules: exports.rules,
 };
@@ -96,22 +89,8 @@ const recommendedRules = {
     'node-security/detect-eval-with-expression': 'error',
     'node-security/detect-non-literal-fs-filename': 'error',
     'node-security/no-unsafe-dynamic-require': 'error',
-    // no-buffer-overread demoted 2026-05-09 — 95% of Wild hits on adversarial
-    // Edge corpus + insufficient fixture coverage for the README §1 promotion
-    // gate. Per `npm run ilb:severity-audit` it's both edge-error AND
-    // volume-error risk. Promote back to 'error' once Edge ratio drops to
-    // ≤ 50% (see `benchmarks/AUDIT_PATTERNS.md` §3.6 — needs typed-array
-    // detection like `detect-object-injection` got in audit iter-1).
     'node-security/no-buffer-overread': 'warn',
-    // Added in 4.1.0. Set to 'warn' in `recommended` to avoid breaking
-    // adopters who already use the preset and have legacy `Buffer()` calls.
-    // Promote to 'error' on the next major bump.
     'node-security/no-deprecated-buffer': 'error',
-    // Added in 4.5.0. Unconditional flag on `Buffer.allocUnsafe()` — a real but
-    // legitimate performance API — so it ships as 'warn', not 'error'. The rule
-    // does no dataflow, so a correctly-overwritten buffer still reports.
-    // Upstream `security-node/detect-buffer-unsafe-allocation` ships this off by
-    // default; 'warn' is the middle ground.
     'node-security/no-unsafe-buffer-alloc': 'warn',
     'node-security/no-toctou-vulnerability': 'error',
     'node-security/no-zip-slip': 'error',
@@ -119,21 +98,12 @@ const recommendedRules = {
     'node-security/no-data-in-temp-storage': 'error',
     'node-security/no-ssrf': 'warn',
     'node-security/no-shell-injection': 'error',
+    'node-security/no-dynamic-command-string': 'error',
     'node-security/no-dynamic-algorithm-selection': 'error',
-    // Added to `recommended` 2026-08-02. `secure-coding/no-insecure-comparison`
-    // was removed from every `secure-coding` preset in favour of this rule, but
-    // this rule was not in any `recommended` preset — so CWE-697 timing-unsafe
-    // comparison had no preset coverage anywhere in the ecosystem, and the
-    // migration note pointed at a rule users would have had to enable by hand.
-    // Enters at 'warn' rather than 'error' for the same reason as
-    // `no-deprecated-buffer` above: adopters already on this preset shouldn't
-    // have CI turn red on a version bump. Promote on the next major.
     'node-security/no-timing-unsafe-compare': 'warn',
-    // Migrated Rules
     'node-security/detect-suspicious-dependencies': 'warn',
-    'node-security/lock-file': 'warn', // filesystem check — not pure AST; CI enforces this better
+    'node-security/lock-file': 'warn',
     'node-security/require-dependency-integrity': 'error',
-    // Crypto rules in recommended
     'node-security/no-weak-hash-algorithm': 'error',
     'node-security/no-weak-cipher-algorithm': 'error',
     'node-security/no-static-iv': 'error',
@@ -159,4 +129,3 @@ exports.configs = {
     },
 };
 exports.default = exports.plugin;
-//# sourceMappingURL=index.js.map

package/src/oxlint.d.ts

@@ -1,20 +1,17 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-node-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-node-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-import { plugin } from './index';
-export = plugin;
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/src/oxlint.js

@@ -1,22 +1,3 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-node-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-node-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
 const index_1 = require("./index");
 module.exports = index_1.plugin;
-//# sourceMappingURL=oxlint.js.map

package/src/rules/detect-child-process/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectChildProcess = exports.generateRefactoringSteps = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -15,7 +10,6 @@ const COMMAND_PATTERNS = [
         vulnerability: 'command-injection',
         safeAlternatives: ['execFile', 'spawn'],
         example: {
-            // oxlint-disable-next-line no-template-curly-in-string
             bad: 'exec(`git clone ${repoUrl}`)',
             good: [
                 'execFile(\'git\', [\'clone\', repoUrl], {shell: false})',
@@ -29,9 +23,7 @@ const COMMAND_PATTERNS = [
         dangerous: true,
         vulnerability: 'command-injection',
         safeAlternatives: ['execFileSync', 'spawnSync'],
-        // oxlint-disable-next-line no-template-curly-in-string
         example: {
-            // oxlint-disable-next-line no-template-curly-in-string
             bad: 'execSync(`npm install ${packageName}`)',
             good: [
                 'execFileSync(\'npm\', [\'install\', packageName], {shell: false})',
@@ -125,13 +117,6 @@ const COMMAND_PATTERNS = [
         effort: '15-20 minutes'
     }
 ];
-/**
- * Generate refactoring steps based on the pattern.
- *
- * Module-scope (rather than inline in `create()`) so the `default` branch —
- * unreachable through COMMAND_PATTERNS, which only contains methods with
- * dedicated cases — is directly unit-testable.
- */
 const generateRefactoringSteps = (pattern) => {
     switch (pattern.method) {
         case 'exec':
@@ -214,7 +199,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             confidence: 'medium',
         },
         messages: {
-            // 🎯 Token optimization: 44% reduction (55→31 tokens) - removes ❌/✅/📚 labels
             childProcessCommandInjection: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.WARNING,
                 issueName: 'Command injection',
@@ -331,9 +315,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
     create(context) {
         const options = context.options[0] || {};
         const { allowLiteralStrings = false, allowLiteralSpawn = false, additionalMethods = [], } = options;
-        /**
-         * Child process methods that can be dangerous (Set for O(1) lookup)
-         */
         const dangerousMethodsSet = new Set([
             'exec',
             'execSync',
@@ -345,16 +326,8 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             'forkSync',
             ...additionalMethods
         ]);
-        /**
-         * Track imported child_process identifiers so we can flag calls like
-         * `exec()` or `cp.exec()` in addition to `child_process.exec()`.
-         */
         const moduleAliases = new Set(['child_process']);
         const importedMethods = new Set();
-        /**
-         * Check if a node contains string interpolation or concatenation
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const containsDynamicStrings = (node) => {
             if (node.type === 'TemplateLiteral') {
                 return node.expressions.length > 0;
@@ -362,26 +335,18 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             if (node.type === 'BinaryExpression' && node.operator === '+') {
                 return true;
             }
-            // Check for variable references
             if (node.type === 'Identifier') {
                 return true;
             }
             return false;
         };
-        /**
-         * Check if command and arguments are literals (safe for execFile/spawn patterns)
-         * We only care about the command (arg 0) and args array (arg 1).
-         * The options object (arg 2) is irrelevant for command injection.
-         */
         const hasOnlyLiteralArgs = (args) => {
             if (args.length === 0)
                 return false;
-            // First argument must be a literal string (the command)
             const command = args[0];
             if (command.type !== 'Literal' || typeof command.value !== 'string') {
                 return false;
             }
-            // Second argument (if present) must be a literal array of literal strings
             if (args.length >= 2) {
                 const argsArray = args[1];
                 if (argsArray.type === 'ArrayExpression') {
@@ -391,45 +356,29 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                     }
                 }
                 else if (argsArray.type !== 'Literal') {
-                    // If second arg is not array or literal, it's dynamic
                     return false;
                 }
             }
-            // Options object (arg 2+) is irrelevant for command injection safety
-            // It may contain callbacks, cwd, env, etc. which are not injection vectors
             return true;
         };
-        /**
-         * Check if spawn/spawnSync has { shell: false } option
-         */
         const hasShellFalseOption = (node) => {
-            // Options is typically the 3rd argument for spawn(cmd, args, options)
             const optionsArg = node.arguments[2];
             if (!optionsArg || optionsArg.type !== eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
-                // No options = default shell: false for spawn
                 return true;
             }
             for (const prop of optionsArg.properties) {
                 if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
                     prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     prop.key.name === 'shell') {
-                    // shell: false is safe
                     if (prop.value.type === eslint_devkit_1.AST_NODE_TYPES.Literal && prop.value.value === false) {
                         return true;
                     }
-                    // shell: true or shell: someVar is not safe
                     return false;
                 }
             }
-            // No shell property = default is false = safe
             return true;
         };
-        /**
-         * Check if a variable is validated against an allowlist before use
-         * Looks for patterns like: if (ALLOWED.includes(arg)) or if (!ALLOWED.includes(arg)) { return/throw }
-         */
         const hasPrecedingAllowlistValidation = (node) => {
-            // Helper: check if an arg node contains a validated variable
             const makeArgChecker = (validatedVarNames) => {
                 const check = (argNode) => {
                     if (argNode.type === 'Identifier' && validatedVarNames.has(argNode.name))
@@ -444,10 +393,8 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 };
                 return check;
             };
-            // Helper: check if a guard clause IfStatement validates any of our call's args
             const checkGuardClause = (ifNode) => {
                 const test = ifNode.test;
-                // Pattern 1: if (ALLOWED.includes(arg)) { ... our call is inside ... }
                 if (test.type === 'CallExpression' &&
                     test.callee.type === 'MemberExpression' &&
                     test.callee.property.type === 'Identifier' &&
@@ -463,7 +410,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                             return true;
                     }
                 }
-                // Pattern 2: if (!ALLOWED.includes(arg)) { throw/return } — guard clause
                 if (test.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression && test.operator === '!' &&
                     test.argument.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                     test.argument.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
@@ -483,7 +429,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                                 validatedVarNames.add(testArg.name);
                         }
                         const check = makeArgChecker(validatedVarNames.size > 0 ? validatedVarNames : new Set(['*']));
-                        // If we have specific validated var names, check them; otherwise check any identifier
                         if (validatedVarNames.size > 0) {
                             for (const arg of node.arguments) {
                                 if (check(arg))
@@ -491,7 +436,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                             }
                         }
                         else {
-                            // No specific args in includes() - treat as generic guard
                             for (const arg of node.arguments) {
                                 if (arg.type === 'Identifier' ||
                                     (arg.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression && arg.elements.some(el => el?.type === 'Identifier'))) {
@@ -503,7 +447,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 }
                 return false;
             };
-            // Pass 1: Walk up parent chain looking for ancestor IfStatements
             let current = node.parent;
             while (current) {
                 if (current.type === 'IfStatement') {
@@ -512,10 +455,7 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 }
                 current = current.parent;
             }
-            // Pass 2: Look for guard clause IfStatements as preceding siblings in the same block
-            // This handles: function f(x) { if (!allowed.includes(x)) throw ...; execFile('cmd', [x]); }
             let stmt = node.parent;
-            // Walk up to find the statement that contains our call in a block
             while (stmt && stmt.parent && stmt.parent.type !== eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
                 stmt = stmt.parent;
             }
@@ -523,7 +463,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 const block = stmt.parent;
                 const callIndex = block.body.indexOf(stmt);
                 if (callIndex > 0) {
-                    // Check preceding siblings for guard clause IfStatements
                     for (let i = 0; i < callIndex; i++) {
                         const sibling = block.body[i];
                         if (sibling.type === 'IfStatement') {
@@ -535,24 +474,13 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             }
             return false;
         };
-        /**
-         * Extract command and arguments for analysis.
-         * `method` comes from getChildProcessCall, which already resolved the
-         * callee shape — re-deriving it here would duplicate that logic behind
-         * an unreachable defensive branch.
-         */
         const extractCommandInfo = (node, method) => {
             const sourceCode = context.sourceCode;
             const args = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
             const pattern = COMMAND_PATTERNS.find(p => p.method === method) || null;
-            // Check if arguments contain dynamic content
             const isDynamic = node.arguments.some((arg) => containsDynamicStrings(arg));
             return { args, pattern, isDynamic };
         };
-        /**
-         * Determine risk level based on the call pattern
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const determineRiskLevel = (pattern, isDynamic) => {
             if (pattern?.dangerous && isDynamic) {
                 return 'critical';
@@ -562,24 +490,18 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             }
             return 'medium';
         };
-        /**
-         * Determine whether the callee refers to a child_process API.
-         */
         const getChildProcessCall = (node) => {
-            // child_process.exec(...)
             if (node.callee.type === 'MemberExpression' &&
                 node.callee.property.type === 'Identifier') {
                 const methodName = node.callee.property.name;
                 if (!dangerousMethodsSet.has(methodName)) {
                     return null;
                 }
-                // child_process.exec(...) or alias.exec(...)
                 if (node.callee.object.type === 'Identifier' &&
                     moduleAliases.has(node.callee.object.name)) {
                     return { method: methodName, calleeNode: node.callee };
                 }
             }
-            // exec(...) when imported directly from child_process
             if (node.callee.type === 'Identifier' && dangerousMethodsSet.has(node.callee.name)) {
                 if (importedMethods.has(node.callee.name)) {
                     return { method: node.callee.name, calleeNode: node.callee };
@@ -587,9 +509,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             }
             return null;
         };
-        /**
-         * Check child_process calls for security issues
-         */
         const checkChildProcessCall = (node) => {
             const detected = getChildProcessCall(node);
             if (!detected) {
@@ -597,43 +516,26 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
             }
             const { method } = detected;
             const { args, pattern, isDynamic } = extractCommandInfo(node, method);
-            // ALWAYS safe: exec/execSync called with a single string literal that
-            // contains no interpolation — there is no user input to inject. The
-            // rule discourages exec() in general (because it's easy to add a
-            // template-literal later), but a fully-literal call is structurally
-            // safe and shouldn't be flagged. Fire-on-stylistic-discouragement is
-            // out of scope for a security rule.
             if ((method === 'exec' || method === 'execSync') && !isDynamic && hasOnlyLiteralArgs(node.arguments)) {
                 return;
             }
-            // Allow literal strings if configured (legacy option, kept for
-            // backward compat with existing user configs).
             if (allowLiteralStrings && method === 'exec' && !isDynamic) {
                 return;
             }
-            // Allow safe methods with literal args if configured
-            // execFile, execFileSync, spawn, spawnSync are inherently safer than exec
-            // when using literal command + literal args array
             const saferMethods = new Set(['spawn', 'spawnSync', 'execFile', 'execFileSync']);
             if (allowLiteralSpawn && saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
                 return;
             }
-            // ALWAYS safe: literal command + ALL literal args (no dynamic input at all).
-            // For execFile/execFileSync: no shell by default, all-literal = nothing to inject.
-            // For spawn/spawnSync: requires shell:false + all-literal args.
             if (saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
                 const isExecFile = method === 'execFile' || method === 'execFileSync';
                 if (isExecFile || hasShellFalseOption(node)) {
                     return;
                 }
             }
-            // Allow safe methods when args are validated against an allowlist
-            // Pattern: if (ALLOWED.includes(arg)) { execFile('cmd', [arg]) }
             const allSafeMethods = ['execFile', 'execFileSync', 'spawn', 'spawnSync'];
             if (allSafeMethods.includes(method) && hasPrecedingAllowlistValidation(node)) {
                 return;
             }
-            // Report the security issue
             const riskLevel = determineRiskLevel(pattern, isDynamic);
             const steps = pattern ? (0, exports.generateRefactoringSteps)(pattern) : 'Review and secure command execution';
             const alternatives = pattern?.safeAlternatives.join(', ') || 'execFile, spawn with validation';
@@ -673,9 +575,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 ]
             });
         };
-        /**
-         * Track imports/requires of child_process to catch alias usage.
-         */
         const trackChildProcessImport = (node) => {
             if (node.source.value !== 'child_process') {
                 return;
@@ -689,14 +588,10 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 }
             }
         };
-        /**
-         * Track CommonJS require patterns.
-         */
         const trackChildProcessRequire = (node) => {
             if (!node.init) {
                 return;
             }
-            // const cp = require('child_process');
             if (node.id.type === 'Identifier' &&
                 node.init.type === 'CallExpression' &&
                 node.init.callee.type === 'Identifier' &&
@@ -707,7 +602,6 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
                 moduleAliases.add(node.id.name);
                 return;
             }
-            // const { exec } = require('child_process');
             if (node.id.type === 'ObjectPattern' &&
                 node.init?.type === 'CallExpression' &&
                 node.init.callee.type === 'Identifier' &&
@@ -729,4 +623,3 @@ exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map