eslint-plugin-node-security 4.6.0 → 4.7.0

package/src/rules/no-dynamic-command-string/index.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noDynamicCommandString = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const ARGV_FUNCTIONS = new Set([
+    'spawn',
+    'spawnSync',
+    'execFile',
+    'execFileSync',
+    'fork',
+]);
+const POSIX_COMMAND_FLAGS = new Set(['-c']);
+const CMD_COMMAND_FLAGS = new Set(['/c', '/C', '/k', '/K']);
+const POWERSHELL_COMMAND_FLAGS = new Set([
+    '-Command',
+    '-command',
+    '-c',
+    '-EncodedCommand',
+    '-encodedcommand',
+    '-e',
+    '-ec',
+]);
+const SHELL_COMMAND_FLAGS = {
+    sh: POSIX_COMMAND_FLAGS,
+    bash: POSIX_COMMAND_FLAGS,
+    zsh: POSIX_COMMAND_FLAGS,
+    dash: POSIX_COMMAND_FLAGS,
+    ksh: POSIX_COMMAND_FLAGS,
+    busybox: POSIX_COMMAND_FLAGS,
+    cmd: CMD_COMMAND_FLAGS,
+    'cmd.exe': CMD_COMMAND_FLAGS,
+    powershell: POWERSHELL_COMMAND_FLAGS,
+    'powershell.exe': POWERSHELL_COMMAND_FLAGS,
+    pwsh: POWERSHELL_COMMAND_FLAGS,
+};
+const COMMAND_RUNNERS = new Set([
+    'execaCommand',
+    'execaCommandSync',
+    '$.raw',
+]);
+function basename(command) {
+    const segments = command.split(/[\\/]/);
+    return segments[segments.length - 1];
+}
+function isAssembledString(node) {
+    if (node.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral) {
+        return node.expressions.length > 0;
+    }
+    if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression) {
+        return node.operator === '+';
+    }
+    return (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier ||
+        node.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+        node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression);
+}
+function calleeName(callee) {
+    if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return callee.name;
+    if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression)
+        return null;
+    if (callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return null;
+    if (callee.computed)
+        return null;
+    if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        callee.object.name === '$') {
+        return `$.${callee.property.name}`;
+    }
+    return callee.property.name;
+}
+exports.noDynamicCommandString = (0, eslint_devkit_1.createRule)({
+    name: 'no-dynamic-command-string',
+    meta: {
+        type: 'problem',
+        docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-command-string.md',
+            description: 'Disallow dynamically assembled command strings passed to a shell flag or to a command-runner that does not escape (CWE-77)',
+            cwe: 'CWE-77',
+            cvss: 9.8,
+            confidence: 'high',
+        },
+        messages: {
+            shellFlagInjection: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Command Injection Through Shell Flag (CWE-77)',
+                cwe: 'CWE-77',
+                cvss: 9.8,
+                description: '{{fn}}("{{shell}}", ["{{flag}}", …]) hands a dynamically built string to {{shell}}, which parses it as a command line. The argument array looks parameterized but everything after {{flag}} is re-parsed — `;`, `&&`, backticks and `$()` all execute.',
+                severity: 'CRITICAL',
+                fix: 'Invoke the target program directly with its own argument array — spawn("kill", [String(pid)]) — instead of routing it through a shell.',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html',
+            }),
+            commandStringInterpolation: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Interpolated Command Line (CWE-77)',
+                cwe: 'CWE-77',
+                cvss: 9.8,
+                description: '{{fn}}() takes a whole command line and does NOT escape interpolated values (unlike the execa/zx tagged-template forms). Any special character in the interpolated value changes which command runs.',
+                severity: 'CRITICAL',
+                fix: 'Use the tagged-template or array form that escapes for you: execa("git", ["clone", url]) or await $`git clone ${url}`.',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/77.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    extraCommandRunners: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        description: 'Extra functions that accept a full command line without escaping',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [{}],
+    create(context, [options]) {
+        const { extraCommandRunners } = options;
+        const runners = new Set([
+            ...COMMAND_RUNNERS,
+            ...(extraCommandRunners ?? []),
+        ]);
+        function checkShellFlag(node, fn) {
+            const command = node.arguments[0];
+            if (!command ||
+                command.type !== eslint_devkit_1.AST_NODE_TYPES.Literal ||
+                typeof command.value !== 'string') {
+                return;
+            }
+            const shell = basename(command.value);
+            const commandFlags = SHELL_COMMAND_FLAGS[shell.toLowerCase()];
+            if (!commandFlags)
+                return;
+            const argv = node.arguments[1];
+            if (!argv || argv.type !== eslint_devkit_1.AST_NODE_TYPES.ArrayExpression)
+                return;
+            for (let i = 0; i < argv.elements.length - 1; i += 1) {
+                const flag = argv.elements[i];
+                if (!flag || flag.type !== eslint_devkit_1.AST_NODE_TYPES.Literal)
+                    continue;
+                if (typeof flag.value !== 'string')
+                    continue;
+                if (!commandFlags.has(flag.value))
+                    continue;
+                const commandString = argv.elements[i + 1];
+                if (!commandString)
+                    continue;
+                if (!isAssembledString(commandString))
+                    continue;
+                context.report({
+                    node: commandString,
+                    messageId: 'shellFlagInjection',
+                    data: { fn, shell, flag: flag.value },
+                });
+                return;
+            }
+        }
+        function checkCommandRunner(node, fn) {
+            const commandLine = node.arguments[0];
+            if (!commandLine)
+                return;
+            if (commandLine.type === eslint_devkit_1.AST_NODE_TYPES.Literal)
+                return;
+            if (!isAssembledString(commandLine))
+                return;
+            context.report({
+                node: commandLine,
+                messageId: 'commandStringInterpolation',
+                data: { fn },
+            });
+        }
+        return {
+            CallExpression(node) {
+                const fn = calleeName(node.callee);
+                if (!fn)
+                    return;
+                if (ARGV_FUNCTIONS.has(fn)) {
+                    checkShellFlag(node, fn);
+                    return;
+                }
+                if (runners.has(fn)) {
+                    checkCommandRunner(node, fn);
+                }
+            },
+            TaggedTemplateExpression(node) {
+                const fn = calleeName(node.tag);
+                if (!fn || !runners.has(fn))
+                    return;
+                if (node.quasi.expressions.length === 0)
+                    return;
+                context.report({
+                    node: node.quasi,
+                    messageId: 'commandStringInterpolation',
+                    data: { fn },
+                });
+            },
+        };
+    },
+});

package/src/rules/no-dynamic-dependency-loading/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDynamicDependencyLoading = void 0;
-/**
- * @fileoverview Prevent dynamic dependency injection
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/494.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
     name: 'no-dynamic-dependency-loading',
@@ -39,7 +29,6 @@ exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
     create(context) {
         return {
             CallExpression(node) {
-                // Dynamic require
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.name === 'require' &&
                     node.arguments[0]?.type !== eslint_devkit_1.AST_NODE_TYPES.Literal) {
@@ -47,7 +36,6 @@ exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
                 }
             },
             ImportExpression(node) {
-                // Dynamic import()
                 if (node.source.type !== 'Literal') {
                     context.report({ node, messageId: 'violationDetected' });
                 }
@@ -55,4 +43,3 @@ exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-dynamic-require/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDynamicRequire = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -75,7 +70,6 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
             }
             return false;
         }
-        // oxlint-disable-next-line consistent-function-scoping
         function isStaticLiteral(node) {
             return node.type === 'Literal' && typeof node.value === 'string';
         }
@@ -88,12 +82,9 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
                     if (isInAllowedContext()) {
                         return;
                     }
-                    // Check if it's a static literal
                     if (isStaticLiteral(requireArg)) {
-                        // Static requires are allowed
                         return;
                     }
-                    // Report dynamic require
                     context.report({
                         node: requireArg,
                         messageId: 'dynamicRequire',
@@ -103,4 +94,3 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-ecb-mode/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noEcbMode = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -72,7 +67,6 @@ exports.noEcbMode = (0, eslint_devkit_1.createRule)({
             if (isTestFile)
                 return;
             const cipherMethods = new Set(['createCipher', 'createCipheriv', 'createDecipher', 'createDecipheriv']);
-            // Check for crypto.createCipher*() pattern
             const isCipherCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 cipherMethods.has(node.callee.property.name)) ||
@@ -112,4 +106,3 @@ exports.noEcbMode = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-insecure-key-derivation/index.js

@@ -1,13 +1,7 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noInsecureKeyDerivation = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-// OWASP 2023 recommendations
 const DEFAULT_MIN_ITERATIONS = 100000;
 exports.noInsecureKeyDerivation = (0, eslint_devkit_1.createRule)({
     name: 'no-insecure-key-derivation',
@@ -77,15 +71,12 @@ exports.noInsecureKeyDerivation = (0, eslint_devkit_1.createRule)({
     create(context, [options = {}]) {
         const { minIterations = DEFAULT_MIN_ITERATIONS } = options;
         function checkCallExpression(node) {
-            // Check for crypto.pbkdf2() or crypto.pbkdf2Sync()
             const isPbkdf2Call = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 (node.callee.property.name === 'pbkdf2' || node.callee.property.name === 'pbkdf2Sync')) ||
                 (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     (node.callee.name === 'pbkdf2' || node.callee.name === 'pbkdf2Sync'));
             if (isPbkdf2Call) {
-                // pbkdf2(password, salt, iterations, keylen, digest, callback)
-                // iterations is the 3rd argument (index 2)
                 const iterationsArg = node.arguments[2];
                 if (iterationsArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof iterationsArg.value === 'number') {
                     const iterations = iterationsArg.value;
@@ -116,4 +107,3 @@ exports.noInsecureKeyDerivation = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-insecure-rsa-padding/index.js

@@ -1,13 +1,7 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noInsecureRsaPadding = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-// Constants for PKCS#1 v1.5 padding (insecure)
 const PKCS1_PADDING_NAMES = new Set([
     'RSA_PKCS1_PADDING',
     'constants.RSA_PKCS1_PADDING',
@@ -70,7 +64,6 @@ exports.noInsecureRsaPadding = (0, eslint_devkit_1.createRule)({
         function checkCallExpression(node) {
             if (isTestFile)
                 return;
-            // Check for privateDecrypt, publicDecrypt, privateEncrypt, publicEncrypt
             const rsaMethods = new Set(['privateDecrypt', 'publicDecrypt', 'privateEncrypt', 'publicEncrypt']);
             const isRsaCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -79,7 +72,6 @@ exports.noInsecureRsaPadding = (0, eslint_devkit_1.createRule)({
                     rsaMethods.has(node.callee.name));
             if (isRsaCall && node.arguments.length >= 1) {
                 const keyArg = node.arguments[0];
-                // Check if first argument is an object with padding property
                 if (keyArg.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
                     for (const prop of keyArg.properties) {
                         if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
@@ -110,4 +102,3 @@ exports.noInsecureRsaPadding = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-math-random-crypto/index.js

@@ -1,13 +1,7 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noMathRandomCrypto = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-// Variable names that suggest cryptographic usage
 const CRYPTO_VARIABLE_PATTERNS = [
     /token/i,
     /key/i,
@@ -29,7 +23,6 @@ const CRYPTO_VARIABLE_PATTERNS = [
     /code/i,
     /verify/i,
 ];
-// Function names that suggest cryptographic usage
 const CRYPTO_FUNCTION_PATTERNS = [
     /generate.*token/i,
     /generate.*key/i,
@@ -104,10 +97,8 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
         const filename = context.filename;
         const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
         function isCryptoContext(node) {
-            // Check variable declaration context
             let current = node.parent;
             while (current) {
-                // Check variable names
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator) {
                     if (current.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                         const varName = current.id.name;
@@ -116,14 +107,12 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check function names
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration && current.id) {
                     const funcName = current.id.name;
                     if (CRYPTO_FUNCTION_PATTERNS.some((p) => p.test(funcName))) {
                         return true;
                     }
                 }
-                // Check assignment to crypto-named property
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.AssignmentExpression) {
                     if (current.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                         current.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
@@ -133,7 +122,6 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check object property
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.Property) {
                     if (current.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                         const propName = current.key.name;
@@ -142,7 +130,6 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check return in crypto-named function
                 if (current.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
                     const func = findContainingFunction(current);
                     if (func) {
@@ -177,13 +164,11 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
             CallExpression(node) {
                 if (isTestFile)
                     return;
-                // Check for Math.random()
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.object.name === 'Math' &&
                     node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.property.name === 'random') {
-                    // Check if used in cryptographic context
                     if (isCryptoContext(node)) {
                         context.report({
                             node,
@@ -191,7 +176,7 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
                             suggest: [
                                 {
                                     messageId: 'useRandomBytes',
-                                    fix: () => null, // Complex refactoring
+                                    fix: () => null,
                                 },
                                 {
                                     messageId: 'useRandomUUID',
@@ -205,4 +190,3 @@ exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-self-signed-certs/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSelfSignedCerts = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -63,7 +58,6 @@ exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
         function checkProperty(node) {
             if (isTestFile)
                 return;
-            // Check for rejectUnauthorized: false
             if (node.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                 node.key.name === 'rejectUnauthorized' &&
                 node.value.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
@@ -85,7 +79,6 @@ exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
         function checkAssignmentExpression(node) {
             if (isTestFile)
                 return;
-            // Check for process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
             if (node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.left.object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                 node.left.object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
@@ -102,7 +95,7 @@ exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
                         suggest: [
                             {
                                 messageId: 'enableValidation',
-                                fix: () => null, // Should remove the assignment
+                                fix: () => null,
                             },
                         ],
                     });
@@ -115,4 +108,3 @@ exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-sha1-hash/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSha1Hash = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -68,13 +63,11 @@ exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
         const { allowInTests = false } = options;
         const filename = context.filename;
         const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        // Track if sha1 was imported from crypto-hash
         let sha1ImportedFromCryptoHash = false;
         return {
             ImportDeclaration(node) {
                 if (isTestFile)
                     return;
-                // Check for: import { sha1 } from 'crypto-hash'
                 if (node.source.value === 'crypto-hash') {
                     for (const specifier of node.specifiers) {
                         if (specifier.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier &&
@@ -106,7 +99,6 @@ exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
             CallExpression(node) {
                 if (isTestFile)
                     return;
-                // Check for sha1() call if imported from crypto-hash
                 if (sha1ImportedFromCryptoHash &&
                     node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     node.callee.name === 'sha1') {
@@ -127,4 +119,3 @@ exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/no-shell-injection/index.js

@@ -1,24 +1,7 @@
 "use strict";
-/**
- * ESLint Rule: no-shell-injection
- * CWE-78: OS Command Injection
- *
- * Fires when child_process shell-execution functions receive a first
- * argument built via string concatenation or template literal expressions.
- *
- * Detection: structural-api. The rule checks the SHAPE of the first argument,
- * not what value flows into it. exec(`git ${cmd}`) fires regardless of what
- * `cmd` contains — the concatenation itself is the signal.
- *
- * Does NOT fire on:
- *   - exec('literal command') — static string, no injection surface
- *   - spawn('cmd', [args]) — args array is the safe parameterization form
- *   - exec(variable) — indirect; data-flow analysis required, out of scope
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noShellInjection = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/** Shell-execution functions from child_process that run the first arg as a shell command. */
 const SHELL_EXEC_FUNCTIONS = new Set([
     'exec', 'execSync',
 ]);
@@ -64,11 +47,9 @@ exports.noShellInjection = (0, eslint_devkit_1.createRule)({
             CallExpression(node) {
                 const callee = node.callee;
                 let fnName = null;
-                // exec('cmd') / execSync('cmd') — bare call
                 if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                     fnName = callee.name;
                 }
-                // require('child_process').exec('cmd') — member access
                 else if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
                     fnName = callee.property.name;
@@ -85,4 +66,3 @@ exports.noShellInjection = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map