eslint-plugin-node-security 4.6.0 → 4.7.0

package/src/rules/no-zip-slip/index.js

@@ -1,29 +1,15 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noZipSlip = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
-/**
- * Check if path contains dangerous traversal sequences
- */
 const containsPathTraversal = (pathText) => {
-    // Check for ../ sequences
     return /\.\.\//.test(pathText) ||
-        /\.\.\\/.test(pathText) || // Windows paths
+        /\.\.\\/.test(pathText) ||
         pathText.startsWith('..') ||
-        /\/\.\./.test(pathText); // Embedded /..
+        /\/\.\./.test(pathText);
 };
-/**
- * Check if destination is dangerous (sensitive system directories)
- * Note: /tmp is NOT dangerous - it's the standard safe temp location
- */
 const isDangerousDestination = (destText) => {
-    // /tmp is SAFE - it's the standard temp location
     if (destText.startsWith('/tmp') || destText.includes('os.tmpdir') || destText.includes('TMPDIR')) {
         return false;
     }
@@ -176,42 +162,27 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
         const options = context.options[0] || {};
         const { archiveFunctions = ['extract', 'extractAll', 'extractAllTo', 'unzip', 'untar', 'extractArchive'], pathValidationFunctions = ['validatePath', 'sanitizePath', 'checkPath', 'safePath'], safeLibraries = ['yauzl', 'safe-archive-extract', 'tar-stream', 'unzipper'], } = options;
         const filename = context.filename;
-        // Safety checks are implemented directly in the handlers
-        /**
-         * Check if this is an archive extraction operation
-         */
         const isArchiveExtraction = (node) => {
             const callee = node.callee;
-            // Check for archive method calls (e.g., zip.extractAllTo)
             if (callee.type === 'MemberExpression' &&
                 callee.property.type === 'Identifier' &&
                 archiveFunctions.includes(callee.property.name)) {
                 return true;
             }
-            // Check for standalone archive functions (e.g., extractArchive)
             if (callee.type === 'Identifier' &&
                 archiveFunctions.includes(callee.name)) {
                 return true;
             }
             return false;
         };
-        /**
-         * Check if path has been validated or sanitized
-         * Detects patterns like:
-         * - validatePath(), sanitizePath() custom functions
-         * - path.basename() sanitization
-         * - startsWith() validation in preceding if-block
-         */
         const isPathValidated = (pathNode) => {
             let current = pathNode;
             while (current) {
-                // Check for custom validation function wrappers
                 if (current.type === 'CallExpression' &&
                     current.callee.type === 'Identifier' &&
                     pathValidationFunctions.includes(current.callee.name)) {
                     return true;
                 }
-                // Check for path.basename() sanitization
                 if (current.type === 'CallExpression' &&
                     current.callee.type === 'MemberExpression' &&
                     current.callee.object.type === 'Identifier' &&
@@ -220,10 +191,8 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                     current.callee.property.name === 'basename') {
                     return true;
                 }
-                // Check for preceding if-block with startsWith validation
                 if (current.type === 'IfStatement') {
                     const test = current.test;
-                    // if (path.startsWith(...)) or if (!path.startsWith(...)) { throw/return }
                     if (test.type === 'CallExpression' &&
                         test.callee.type === 'MemberExpression' &&
                         test.callee.property.type === 'Identifier' &&
@@ -237,7 +206,6 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         test.argument.callee.property.name === 'startsWith') {
                         return true;
                     }
-                    // if (path.includes('..')) { throw/return }
                     if (test.type === 'CallExpression' &&
                         test.callee.type === 'MemberExpression' &&
                         test.callee.property.type === 'Identifier' &&
@@ -249,20 +217,13 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
             }
             return false;
         };
-        /**
-         * Check if this uses a safe library
-         * Safe libraries have built-in path validation or are known to be secure
-         */
         const isSafeLibrary = (node) => {
             const callee = node.callee;
-            // Check for method calls on safe library instances (e.g., yauzl.open())
             if (callee.type === 'MemberExpression' &&
                 callee.object.type === 'Identifier' &&
                 safeLibraries.includes(callee.object.name)) {
                 return true;
             }
-            // Check for direct calls to safe library functions (e.g., extract(file, opts))
-            // This handles patterns like: const extract = require('extract-zip'); extract(...)
             if (callee.type === 'Identifier') {
                 const name = callee.name.toLowerCase();
                 if (name === 'extract' || name === 'unzipper' ||
@@ -273,13 +234,10 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
             return false;
         };
         return {
-            // Check archive extraction calls
             CallExpression(node) {
                 if (isArchiveExtraction(node) && !isSafeLibrary(node)) {
-                    // Check for @safe annotations in the source
                     const sourceCode = context.sourceCode;
                     let hasSafeAnnotation = false;
-                    // Look for @safe comments in the source code
                     const allComments = sourceCode.getAllComments();
                     for (const comment of allComments) {
                         if (comment.type === 'Block' && comment.value.includes('@safe')) {
@@ -288,36 +246,26 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         }
                     }
                     if (hasSafeAnnotation) {
-                        return; // Skip reporting if marked as safe
+                        return;
                     }
-                    // Check if destination is dangerous
                     const args = node.arguments;
                     let destArg;
-                    // Determine which argument is the destination based on the function
                     if (node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier') {
                         const methodName = node.callee.property.name;
                         if (['extractAllTo', 'unzip'].includes(methodName)) {
-                            // Destination is the first argument
                             destArg = args[0];
                         }
                         else {
-                            // For other archive functions, destination is typically the
-                            // second argument. isArchiveExtraction() already guaranteed
-                            // methodName is listed in archiveFunctions for member callees.
                             destArg = args.length >= 2 ? args[1] : undefined;
                         }
                     }
                     else {
-                        // For standalone functions like extractArchive(file, dest);
-                        // isArchiveExtraction() already guaranteed the callee is an
-                        // Identifier naming an archive function.
                         destArg = args.length >= 2 ? args[1] : undefined;
                     }
                     const destText = destArg && destArg.type === 'Literal' && typeof destArg.value === 'string' ? destArg.value : '';
                     const isDestDangerous = isDangerousDestination(destText);
                     const isMethodCall = node.callee.type === 'MemberExpression';
                     if (isMethodCall) {
-                        // Method calls report unsafeArchiveExtraction unless destination is a safe relative path
                         const isSafeRelativePath = destText.startsWith('./') || destText.startsWith('../');
                         if (!isSafeRelativePath) {
                             context.report({
@@ -335,10 +283,6 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                                 ],
                             });
                         }
-                        // For safe relative paths, don't report any error
-                        // Additionally report dangerous destination for dangerous destinations.
-                        // `isDestDangerous` implies `destArg` is a string Literal (destText
-                        // is derived from it), so no `|| node` fallback is needed here.
                         if (isDestDangerous && destArg) {
                             context.report({
                                 node: destArg,
@@ -351,7 +295,6 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         }
                     }
                     else {
-                        // Standalone calls: report dangerousArchiveDestination for dangerous destinations, unsafeArchiveExtraction otherwise
                         if (isDestDangerous) {
                             context.report({
                                 node,
@@ -380,18 +323,15 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // Check for path.join or similar operations with archive entry names
                 const callee = node.callee;
                 if (callee.type === 'MemberExpression' &&
                     callee.property.type === 'Identifier' &&
                     ['join', 'resolve', 'relative', 'normalize'].includes(callee.property.name)) {
-                    // Check arguments for potential archive entry usage
                     const args = node.arguments;
                     for (const arg of args) {
                         if (arg.type === 'MemberExpression' &&
                             arg.property.type === 'Identifier' &&
                             ['name', 'path', 'fileName', 'entryName', 'relativePath', 'filename', 'pathname'].includes(arg.property.name)) {
-                            // This looks like path.join(dest, entry.name) - check if validated
                             if (!isPathValidated(arg)) {
                                 context.report({
                                     node: arg,
@@ -406,19 +346,14 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                     }
                 }
             },
-            // Check string literals for dangerous paths
             Literal(node) {
                 if (typeof node.value !== 'string') {
                     return;
                 }
                 const text = node.value;
-                // Check for path traversal in strings that look like file paths
                 if ((text.includes('/') || text.includes('\\')) && containsPathTraversal(text)) {
-                    // Check if this is in an archive-related context
                     let current = node;
                     let isArchiveContext = false;
-                    // Every assignment of `isArchiveContext = true` is followed by `break`,
-                    // so the negation is dead (CodeQL: `js/useless-conditional`).
                     while (current) {
                         if (current.type === 'CallExpression' && isArchiveExtraction(current)) {
                             isArchiveContext = true;
@@ -437,7 +372,6 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         }
                         current = current.parent;
                     }
-                    // Also check if the variable name suggests archive usage
                     const parent = node.parent;
                     if (parent && parent.type === 'VariableDeclarator' && parent.id.type === 'Identifier') {
                         const varName = parent.id.name.toLowerCase();
@@ -458,31 +392,19 @@ exports.noZipSlip = (0, eslint_devkit_1.createRule)({
                         });
                     }
                 }
-                // Dangerous-destination check moved to the CallExpression handler
-                // (see lines 407-427). It already fires `dangerousArchiveDestination`
-                // for archive-extraction calls; firing again here would duplicate.
-                // The previous "fire on any /etc or /home literal" logic produced
-                // false positives on unrelated calls (fs.readFileSync, exec, etc.)
-                // and is no longer needed now that the call-site check is precise.
             },
-            // Check variable assignments
             VariableDeclarator(node) {
                 if (!node.init || node.id.type !== 'Identifier') {
                     return;
                 }
                 const varName = node.id.name.toLowerCase();
-                // Check if this variable holds archive-related data
                 if (varName.includes('entry') || varName.includes('file') || varName.includes('path')) {
                     if (node.init.type === 'MemberExpression' &&
                         node.init.property.type === 'Identifier' &&
                         ['name', 'path'].includes(node.init.property.name)) {
-                        // This looks like: const entryName = entry.name;
-                        // Check if this variable is used unsafely later
-                        // This is a simplified check - in practice we'd need more sophisticated analysis
                     }
                 }
             }
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/prefer-native-crypto/index.js

@@ -1,21 +1,15 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.preferNativeCrypto = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-// Third-party crypto libraries that should be replaced with native
 const THIRD_PARTY_CRYPTO_LIBS = new Set([
     'crypto-js',
     'cryptojs',
-    'sjcl', // Stanford JavaScript Crypto Library
-    'forge', // node-forge
+    'sjcl',
+    'forge',
     'node-forge',
     'jsencrypt',
-    'bcryptjs', // pure JS bcrypt (prefer native bcrypt)
+    'bcryptjs',
     'js-sha256',
     'js-sha512',
     'js-sha3',
@@ -102,7 +96,7 @@ exports.preferNativeCrypto = (0, eslint_devkit_1.createRule)({
         return {
             ImportDeclaration(node) {
                 if (typeof node.source.value === 'string') {
-                    const lib = node.source.value.split('/')[0]; // Get base package name
+                    const lib = node.source.value.split('/')[0];
                     if (THIRD_PARTY_CRYPTO_LIBS.has(lib)) {
                         reportThirdPartyLib(node, lib);
                     }
@@ -123,4 +117,3 @@ exports.preferNativeCrypto = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/require-dependency-integrity/index.js

@@ -1,14 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireDependencyIntegrity = void 0;
-/**
- * @fileoverview Require integrity hashes for external resources
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireDependencyIntegrity = (0, eslint_devkit_1.createRule)({
     name: 'require-dependency-integrity',
@@ -42,11 +34,9 @@ exports.requireDependencyIntegrity = (0, eslint_devkit_1.createRule)({
             Literal(node) {
                 if (typeof node.value !== 'string')
                     return;
-                // Check for script/link tags without integrity
                 const value = node.value.toLowerCase();
                 if ((value.includes('<script') && value.includes('src=')) ||
                     (value.includes('<link') && value.includes('href='))) {
-                    // Check if CDN source
                     if (value.includes('cdn.') || value.includes('cdnjs.') ||
                         value.includes('unpkg.') || value.includes('jsdelivr.')) {
                         if (!value.includes('integrity=')) {
@@ -70,4 +60,3 @@ exports.requireDependencyIntegrity = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/require-secure-credential-storage/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireSecureCredentialStorage = void 0;
-/**
- * @fileoverview Enforce secure storage patterns for credentials
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/522.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireSecureCredentialStorage = (0, eslint_devkit_1.createRule)({
     name: 'require-secure-credential-storage',
@@ -42,7 +32,6 @@ exports.requireSecureCredentialStorage = (0, eslint_devkit_1.createRule)({
                 if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
                     node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                     ['setItem', 'writeFile'].includes(node.callee.property.name)) {
-                    // Check for encryption wrapper
                     const hasEncryption = node.arguments.some(arg => arg.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
                         arg.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
                         arg.callee.name.includes('encrypt'));
@@ -54,4 +43,3 @@ exports.requireSecureCredentialStorage = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/require-secure-deletion/index.js

@@ -1,29 +1,7 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireSecureDeletion = void 0;
-/**
- * @fileoverview Require secure data deletion patterns
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/459.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/**
- * Property-name fragments that mark a value as a secret whose lifetime matters.
- *
- * `delete` unbinds a property; it does not scrub the string, and every other
- * reference (a spread copy, a log line, an already-serialised response body)
- * keeps the value alive. That is the CWE-459 "incomplete cleanup" this rule is
- * about — and it only means anything when the property actually held a secret.
- *
- * Matching is on the property NAME, deliberately: the value at a `delete` site
- * is not available to a syntactic rule, so the name is the only signal there
- * is. The cost of that is bounded by keeping this list narrow.
- */
 const SENSITIVE_PROPERTY_FRAGMENTS = [
     'password', 'passwd', 'pwd', 'passphrase',
     'secret', 'apikey', 'api_key',
@@ -75,9 +53,7 @@ exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
             ...SENSITIVE_PROPERTY_FRAGMENTS,
             ...additionalSensitiveProperties.map((f) => f.toLowerCase()),
         ];
-        /** The property name being deleted, or undefined if it isn't statically known. */
         function deletedPropertyName(node) {
-            // `delete obj?.password` wraps the member expression in a ChainExpression.
             const argument = node.type === 'ChainExpression' ? node.expression : node;
             if (argument.type !== 'MemberExpression')
                 return undefined;
@@ -93,10 +69,6 @@ exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
             UnaryExpression(node) {
                 if (node.operator !== 'delete')
                     return;
-                // Only a `delete` of a *named, statically known, sensitive* property is
-                // reportable. Firing on every `delete obj.prop` produced 120 findings
-                // on a 1,470-file corpus with no security content whatsoever — the rule
-                // was a `delete` detector, not a secret-cleanup detector.
                 const property = deletedPropertyName(node.argument);
                 if (!property)
                     return;
@@ -108,4 +80,3 @@ exports.requireSecureDeletion = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/rules/require-storage-encryption/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireStorageEncryption = void 0;
-/**
- * @fileoverview Require encryption for persistent storage
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/311.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireStorageEncryption = (0, eslint_devkit_1.createRule)({
     name: 'require-storage-encryption',
@@ -42,7 +32,6 @@ exports.requireStorageEncryption = (0, eslint_devkit_1.createRule)({
                 if (node.callee.type === 'MemberExpression' &&
                     node.callee.property.type === 'Identifier' &&
                     ['setItem', 'writeFile'].includes(node.callee.property.name)) {
-                    // Check for encryption wrapper
                     const hasEncryption = node.arguments.some(arg => arg.type === 'CallExpression' &&
                         arg.callee.type === 'Identifier' &&
                         arg.callee.name.includes('encrypt'));
@@ -54,4 +43,3 @@ exports.requireStorageEncryption = (0, eslint_devkit_1.createRule)({
         };
     },
 });
-//# sourceMappingURL=index.js.map

package/src/types/index.js

@@ -1,8 +1,2 @@
 "use strict";
-/**
- * eslint-plugin-node-security Type Exports
- *
- * Barrel file that exports all Node.js security rule Options types.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=index.js.map