eslint-plugin-node-security 4.7.1 → 4.7.3

package/README.md

@@ -1,7 +1,11 @@
 <p align="center">
-  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="90" /></a>
+  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-node-security" target="blank"><img src="https://eslint.interlace.tools/logos/interlace.svg" alt="Interlace" height="90" /></a>
   &nbsp;&nbsp;
-  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/eslint-logo.svg" alt="ESLint" height="90" /></a>
+  <a href="https://nodejs.org" target="_blank"><img src="https://eslint.interlace.tools/logos/node.svg" alt="Node.js" height="90" /></a>
+  &nbsp;&nbsp;
+  <a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/logos/oxlint.svg" alt="oxlint" height="90" /></a>
+  &nbsp;&nbsp;
+  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/logos/eslint.svg" alt="ESLint" height="90" /></a>
 </p>
 
 <p align="center">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.7.1",
+  "version": "4.7.3",
   "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -78,8 +78,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.6.1"
+    "@interlace/eslint-devkit": "^1.8.0"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

package/src/index.js

@@ -1,86 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configs = exports.plugin = exports.rules = void 0;
-const detect_child_process_1 = require("./rules/detect-child-process");
-const detect_eval_with_expression_1 = require("./rules/detect-eval-with-expression");
-const detect_non_literal_fs_filename_1 = require("./rules/detect-non-literal-fs-filename");
-const no_unsafe_dynamic_require_1 = require("./rules/no-unsafe-dynamic-require");
-const no_buffer_overread_1 = require("./rules/no-buffer-overread");
-const no_deprecated_buffer_1 = require("./rules/no-deprecated-buffer");
-const no_unsafe_buffer_alloc_1 = require("./rules/no-unsafe-buffer-alloc");
-const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
-const no_zip_slip_1 = require("./rules/no-zip-slip");
-const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
-const no_data_in_temp_storage_1 = require("./rules/no-data-in-temp-storage");
-const no_ssrf_1 = require("./rules/no-ssrf");
-const no_shell_injection_1 = require("./rules/no-shell-injection");
-const no_dynamic_command_string_1 = require("./rules/no-dynamic-command-string");
-const no_dynamic_algorithm_selection_1 = require("./rules/no-dynamic-algorithm-selection");
-const detect_suspicious_dependencies_1 = require("./rules/detect-suspicious-dependencies");
-const lock_file_1 = require("./rules/lock-file");
-const no_dynamic_dependency_loading_1 = require("./rules/no-dynamic-dependency-loading");
-const require_dependency_integrity_1 = require("./rules/require-dependency-integrity");
-const require_secure_credential_storage_1 = require("./rules/require-secure-credential-storage");
-const require_secure_deletion_1 = require("./rules/require-secure-deletion");
-const require_storage_encryption_1 = require("./rules/require-storage-encryption");
-const no_dynamic_require_1 = require("./rules/no-dynamic-require");
-const no_cryptojs_1 = require("./rules/no-cryptojs");
-const no_cryptojs_weak_random_1 = require("./rules/no-cryptojs-weak-random");
-const no_deprecated_cipher_method_1 = require("./rules/no-deprecated-cipher-method");
-const no_ecb_mode_1 = require("./rules/no-ecb-mode");
-const no_insecure_key_derivation_1 = require("./rules/no-insecure-key-derivation");
-const no_math_random_crypto_1 = require("./rules/no-math-random-crypto");
-const no_insecure_rsa_padding_1 = require("./rules/no-insecure-rsa-padding");
-const no_self_signed_certs_1 = require("./rules/no-self-signed-certs");
-const no_sha1_hash_1 = require("./rules/no-sha1-hash");
-const no_static_iv_1 = require("./rules/no-static-iv");
-const no_timing_unsafe_compare_1 = require("./rules/no-timing-unsafe-compare");
-const no_weak_cipher_algorithm_1 = require("./rules/no-weak-cipher-algorithm");
-const no_weak_hash_algorithm_1 = require("./rules/no-weak-hash-algorithm");
-const prefer_native_crypto_1 = require("./rules/prefer-native-crypto");
 exports.rules = {
-    'detect-child-process': detect_child_process_1.detectChildProcess,
-    'detect-eval-with-expression': detect_eval_with_expression_1.detectEvalWithExpression,
-    'detect-non-literal-fs-filename': detect_non_literal_fs_filename_1.detectNonLiteralFsFilename,
-    'no-unsafe-dynamic-require': no_unsafe_dynamic_require_1.noUnsafeDynamicRequire,
-    'no-buffer-overread': no_buffer_overread_1.noBufferOverread,
-    'no-deprecated-buffer': no_deprecated_buffer_1.noDeprecatedBuffer,
-    'no-unsafe-buffer-alloc': no_unsafe_buffer_alloc_1.noUnsafeBufferAlloc,
-    'no-toctou-vulnerability': no_toctou_vulnerability_1.noToctouVulnerability,
-    'no-zip-slip': no_zip_slip_1.noZipSlip,
-    'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
-    'no-data-in-temp-storage': no_data_in_temp_storage_1.noDataInTempStorage,
-    'no-ssrf': no_ssrf_1.noSsrf,
-    'no-shell-injection': no_shell_injection_1.noShellInjection,
-    'no-dynamic-command-string': no_dynamic_command_string_1.noDynamicCommandString,
-    'no-dynamic-algorithm-selection': no_dynamic_algorithm_selection_1.noDynamicAlgorithmSelection,
-    'detect-suspicious-dependencies': detect_suspicious_dependencies_1.detectSuspiciousDependencies,
-    'lock-file': lock_file_1.lockFile,
-    'no-dynamic-dependency-loading': no_dynamic_dependency_loading_1.noDynamicDependencyLoading,
-    'require-dependency-integrity': require_dependency_integrity_1.requireDependencyIntegrity,
-    'require-secure-credential-storage': require_secure_credential_storage_1.requireSecureCredentialStorage,
-    'require-secure-deletion': require_secure_deletion_1.requireSecureDeletion,
-    'require-storage-encryption': require_storage_encryption_1.requireStorageEncryption,
-    'no-dynamic-require': no_dynamic_require_1.noDynamicRequire,
-    'no-cryptojs': no_cryptojs_1.noCryptojs,
-    'no-cryptojs-weak-random': no_cryptojs_weak_random_1.noCryptojsWeakRandom,
-    'no-deprecated-cipher-method': no_deprecated_cipher_method_1.noDeprecatedCipherMethod,
-    'no-ecb-mode': no_ecb_mode_1.noEcbMode,
-    'no-insecure-key-derivation': no_insecure_key_derivation_1.noInsecureKeyDerivation,
-    'no-insecure-rsa-padding': no_insecure_rsa_padding_1.noInsecureRsaPadding,
-    'no-math-random-crypto': no_math_random_crypto_1.noMathRandomCrypto,
-    'no-self-signed-certs': no_self_signed_certs_1.noSelfSignedCerts,
-    'no-sha1-hash': no_sha1_hash_1.noSha1Hash,
-    'no-static-iv': no_static_iv_1.noStaticIv,
-    'no-timing-unsafe-compare': no_timing_unsafe_compare_1.noTimingUnsafeCompare,
-    'no-weak-cipher-algorithm': no_weak_cipher_algorithm_1.noWeakCipherAlgorithm,
-    'no-weak-hash-algorithm': no_weak_hash_algorithm_1.noWeakHashAlgorithm,
-    'prefer-native-crypto': prefer_native_crypto_1.preferNativeCrypto,
+    get 'detect-child-process'() { return require("./rules/detect-child-process").detectChildProcess; },
+    get 'detect-eval-with-expression'() { return require("./rules/detect-eval-with-expression").detectEvalWithExpression; },
+    get 'detect-non-literal-fs-filename'() { return require("./rules/detect-non-literal-fs-filename").detectNonLiteralFsFilename; },
+    get 'no-unsafe-dynamic-require'() { return require("./rules/no-unsafe-dynamic-require").noUnsafeDynamicRequire; },
+    get 'no-buffer-overread'() { return require("./rules/no-buffer-overread").noBufferOverread; },
+    get 'no-deprecated-buffer'() { return require("./rules/no-deprecated-buffer").noDeprecatedBuffer; },
+    get 'no-unsafe-buffer-alloc'() { return require("./rules/no-unsafe-buffer-alloc").noUnsafeBufferAlloc; },
+    get 'no-toctou-vulnerability'() { return require("./rules/no-toctou-vulnerability").noToctouVulnerability; },
+    get 'no-zip-slip'() { return require("./rules/no-zip-slip").noZipSlip; },
+    get 'no-arbitrary-file-access'() { return require("./rules/no-arbitrary-file-access").noArbitraryFileAccess; },
+    get 'no-data-in-temp-storage'() { return require("./rules/no-data-in-temp-storage").noDataInTempStorage; },
+    get 'no-ssrf'() { return require("./rules/no-ssrf").noSsrf; },
+    get 'no-shell-injection'() { return require("./rules/no-shell-injection").noShellInjection; },
+    get 'no-dynamic-command-string'() { return require("./rules/no-dynamic-command-string").noDynamicCommandString; },
+    get 'no-dynamic-algorithm-selection'() { return require("./rules/no-dynamic-algorithm-selection").noDynamicAlgorithmSelection; },
+    get 'detect-suspicious-dependencies'() { return require("./rules/detect-suspicious-dependencies").detectSuspiciousDependencies; },
+    get 'lock-file'() { return require("./rules/lock-file").lockFile; },
+    get 'no-dynamic-dependency-loading'() { return require("./rules/no-dynamic-dependency-loading").noDynamicDependencyLoading; },
+    get 'require-dependency-integrity'() { return require("./rules/require-dependency-integrity").requireDependencyIntegrity; },
+    get 'require-secure-credential-storage'() { return require("./rules/require-secure-credential-storage").requireSecureCredentialStorage; },
+    get 'require-secure-deletion'() { return require("./rules/require-secure-deletion").requireSecureDeletion; },
+    get 'require-storage-encryption'() { return require("./rules/require-storage-encryption").requireStorageEncryption; },
+    get 'no-dynamic-require'() { return require("./rules/no-dynamic-require").noDynamicRequire; },
+    get 'no-cryptojs'() { return require("./rules/no-cryptojs").noCryptojs; },
+    get 'no-cryptojs-weak-random'() { return require("./rules/no-cryptojs-weak-random").noCryptojsWeakRandom; },
+    get 'no-deprecated-cipher-method'() { return require("./rules/no-deprecated-cipher-method").noDeprecatedCipherMethod; },
+    get 'no-ecb-mode'() { return require("./rules/no-ecb-mode").noEcbMode; },
+    get 'no-insecure-key-derivation'() { return require("./rules/no-insecure-key-derivation").noInsecureKeyDerivation; },
+    get 'no-insecure-rsa-padding'() { return require("./rules/no-insecure-rsa-padding").noInsecureRsaPadding; },
+    get 'no-math-random-crypto'() { return require("./rules/no-math-random-crypto").noMathRandomCrypto; },
+    get 'no-self-signed-certs'() { return require("./rules/no-self-signed-certs").noSelfSignedCerts; },
+    get 'no-sha1-hash'() { return require("./rules/no-sha1-hash").noSha1Hash; },
+    get 'no-static-iv'() { return require("./rules/no-static-iv").noStaticIv; },
+    get 'no-timing-unsafe-compare'() { return require("./rules/no-timing-unsafe-compare").noTimingUnsafeCompare; },
+    get 'no-weak-cipher-algorithm'() { return require("./rules/no-weak-cipher-algorithm").noWeakCipherAlgorithm; },
+    get 'no-weak-hash-algorithm'() { return require("./rules/no-weak-hash-algorithm").noWeakHashAlgorithm; },
+    get 'prefer-native-crypto'() { return require("./rules/prefer-native-crypto").preferNativeCrypto; },
+
 };
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.7.1',
+        version: '4.7.3',
     },
     rules: exports.rules,
 };

package/src/rules/lock-file/index.js

@@ -29,7 +29,7 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
                 properties: {
                     packageManager: {
                         type: 'string',
-                        enum: ['npm', 'yarn', 'pnpm'],
+                        enum: ['npm', 'yarn', 'pnpm'], description: 'Package manager whose lock file is required'
                     },
                 },
                 additionalProperties: false,

package/src/rules/no-buffer-overread/index.js

@@ -132,17 +132,17 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                     bufferMethods: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'],
+                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], description: 'Buffer read/write methods checked for bounds'
                     },
                     boundsCheckFunctions: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'],
+                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], description: 'Function names that count as a bounds check'
                     },
                     bufferTypes: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'],
+                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], description: 'Constructor names treated as buffer types'
                     },
                     trustedSanitizers: {
                         type: 'array',

package/src/rules/no-toctou-vulnerability/index.js

@@ -60,7 +60,7 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
                     fsMethods: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'],
+                        default: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'], description: 'Filesystem check calls that create a time-of-check window'
                     },
                 },
                 additionalProperties: false,