eslint-plugin-node-security 4.7.2 → 4.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.7.2",
+  "version": "4.8.0",
   "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -78,8 +78,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.6.1"
+    "@interlace/eslint-devkit": "^1.9.0"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

package/src/index.js

@@ -1,93 +1,57 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configs = exports.plugin = exports.rules = void 0;
-const detect_child_process_1 = require("./rules/detect-child-process");
-const detect_eval_with_expression_1 = require("./rules/detect-eval-with-expression");
-const detect_non_literal_fs_filename_1 = require("./rules/detect-non-literal-fs-filename");
-const no_unsafe_dynamic_require_1 = require("./rules/no-unsafe-dynamic-require");
-const no_buffer_overread_1 = require("./rules/no-buffer-overread");
-const no_deprecated_buffer_1 = require("./rules/no-deprecated-buffer");
-const no_unsafe_buffer_alloc_1 = require("./rules/no-unsafe-buffer-alloc");
-const no_toctou_vulnerability_1 = require("./rules/no-toctou-vulnerability");
-const no_zip_slip_1 = require("./rules/no-zip-slip");
-const no_arbitrary_file_access_1 = require("./rules/no-arbitrary-file-access");
-const no_data_in_temp_storage_1 = require("./rules/no-data-in-temp-storage");
-const no_ssrf_1 = require("./rules/no-ssrf");
-const no_shell_injection_1 = require("./rules/no-shell-injection");
-const no_dynamic_command_string_1 = require("./rules/no-dynamic-command-string");
-const no_dynamic_algorithm_selection_1 = require("./rules/no-dynamic-algorithm-selection");
-const detect_suspicious_dependencies_1 = require("./rules/detect-suspicious-dependencies");
-const lock_file_1 = require("./rules/lock-file");
-const no_dynamic_dependency_loading_1 = require("./rules/no-dynamic-dependency-loading");
-const require_dependency_integrity_1 = require("./rules/require-dependency-integrity");
-const require_secure_credential_storage_1 = require("./rules/require-secure-credential-storage");
-const require_secure_deletion_1 = require("./rules/require-secure-deletion");
-const require_storage_encryption_1 = require("./rules/require-storage-encryption");
-const no_dynamic_require_1 = require("./rules/no-dynamic-require");
-const no_cryptojs_1 = require("./rules/no-cryptojs");
-const no_cryptojs_weak_random_1 = require("./rules/no-cryptojs-weak-random");
-const no_deprecated_cipher_method_1 = require("./rules/no-deprecated-cipher-method");
-const no_ecb_mode_1 = require("./rules/no-ecb-mode");
-const no_insecure_key_derivation_1 = require("./rules/no-insecure-key-derivation");
-const no_math_random_crypto_1 = require("./rules/no-math-random-crypto");
-const no_insecure_rsa_padding_1 = require("./rules/no-insecure-rsa-padding");
-const no_self_signed_certs_1 = require("./rules/no-self-signed-certs");
-const no_sha1_hash_1 = require("./rules/no-sha1-hash");
-const no_static_iv_1 = require("./rules/no-static-iv");
-const no_timing_unsafe_compare_1 = require("./rules/no-timing-unsafe-compare");
-const no_weak_cipher_algorithm_1 = require("./rules/no-weak-cipher-algorithm");
-const no_weak_hash_algorithm_1 = require("./rules/no-weak-hash-algorithm");
-const prefer_native_crypto_1 = require("./rules/prefer-native-crypto");
 exports.rules = {
-    'detect-child-process': detect_child_process_1.detectChildProcess,
-    'detect-eval-with-expression': detect_eval_with_expression_1.detectEvalWithExpression,
-    'detect-non-literal-fs-filename': detect_non_literal_fs_filename_1.detectNonLiteralFsFilename,
-    'no-unsafe-dynamic-require': no_unsafe_dynamic_require_1.noUnsafeDynamicRequire,
-    'no-buffer-overread': no_buffer_overread_1.noBufferOverread,
-    'no-deprecated-buffer': no_deprecated_buffer_1.noDeprecatedBuffer,
-    'no-unsafe-buffer-alloc': no_unsafe_buffer_alloc_1.noUnsafeBufferAlloc,
-    'no-toctou-vulnerability': no_toctou_vulnerability_1.noToctouVulnerability,
-    'no-zip-slip': no_zip_slip_1.noZipSlip,
-    'no-arbitrary-file-access': no_arbitrary_file_access_1.noArbitraryFileAccess,
-    'no-data-in-temp-storage': no_data_in_temp_storage_1.noDataInTempStorage,
-    'no-ssrf': no_ssrf_1.noSsrf,
-    'no-shell-injection': no_shell_injection_1.noShellInjection,
-    'no-dynamic-command-string': no_dynamic_command_string_1.noDynamicCommandString,
-    'no-dynamic-algorithm-selection': no_dynamic_algorithm_selection_1.noDynamicAlgorithmSelection,
-    'detect-suspicious-dependencies': detect_suspicious_dependencies_1.detectSuspiciousDependencies,
-    'lock-file': lock_file_1.lockFile,
-    'no-dynamic-dependency-loading': no_dynamic_dependency_loading_1.noDynamicDependencyLoading,
-    'require-dependency-integrity': require_dependency_integrity_1.requireDependencyIntegrity,
-    'require-secure-credential-storage': require_secure_credential_storage_1.requireSecureCredentialStorage,
-    'require-secure-deletion': require_secure_deletion_1.requireSecureDeletion,
-    'require-storage-encryption': require_storage_encryption_1.requireStorageEncryption,
-    'no-dynamic-require': no_dynamic_require_1.noDynamicRequire,
-    'no-cryptojs': no_cryptojs_1.noCryptojs,
-    'no-cryptojs-weak-random': no_cryptojs_weak_random_1.noCryptojsWeakRandom,
-    'no-deprecated-cipher-method': no_deprecated_cipher_method_1.noDeprecatedCipherMethod,
-    'no-ecb-mode': no_ecb_mode_1.noEcbMode,
-    'no-insecure-key-derivation': no_insecure_key_derivation_1.noInsecureKeyDerivation,
-    'no-insecure-rsa-padding': no_insecure_rsa_padding_1.noInsecureRsaPadding,
-    'no-math-random-crypto': no_math_random_crypto_1.noMathRandomCrypto,
-    'no-self-signed-certs': no_self_signed_certs_1.noSelfSignedCerts,
-    'no-sha1-hash': no_sha1_hash_1.noSha1Hash,
-    'no-static-iv': no_static_iv_1.noStaticIv,
-    'no-timing-unsafe-compare': no_timing_unsafe_compare_1.noTimingUnsafeCompare,
-    'no-weak-cipher-algorithm': no_weak_cipher_algorithm_1.noWeakCipherAlgorithm,
-    'no-weak-hash-algorithm': no_weak_hash_algorithm_1.noWeakHashAlgorithm,
-    'prefer-native-crypto': prefer_native_crypto_1.preferNativeCrypto,
+    get 'detect-child-process'() { return require("./rules/detect-child-process").detectChildProcess; },
+    get 'detect-eval-with-expression'() { return require("./rules/detect-eval-with-expression").detectEvalWithExpression; },
+    get 'detect-non-literal-fs-filename'() { return require("./rules/detect-non-literal-fs-filename").detectNonLiteralFsFilename; },
+    get 'no-unsafe-dynamic-require'() { return require("./rules/no-unsafe-dynamic-require").noUnsafeDynamicRequire; },
+    get 'no-buffer-overread'() { return require("./rules/no-buffer-overread").noBufferOverread; },
+    get 'no-deprecated-buffer'() { return require("./rules/no-deprecated-buffer").noDeprecatedBuffer; },
+    get 'no-unsafe-buffer-alloc'() { return require("./rules/no-unsafe-buffer-alloc").noUnsafeBufferAlloc; },
+    get 'no-toctou-vulnerability'() { return require("./rules/no-toctou-vulnerability").noToctouVulnerability; },
+    get 'no-zip-slip'() { return require("./rules/no-zip-slip").noZipSlip; },
+    get 'no-arbitrary-file-access'() { return require("./rules/no-arbitrary-file-access").noArbitraryFileAccess; },
+    get 'no-data-in-temp-storage'() { return require("./rules/no-data-in-temp-storage").noDataInTempStorage; },
+    get 'no-ssrf'() { return require("./rules/no-ssrf").noSsrf; },
+    get 'no-shell-injection'() { return require("./rules/no-shell-injection").noShellInjection; },
+    get 'no-dynamic-command-string'() { return require("./rules/no-dynamic-command-string").noDynamicCommandString; },
+    get 'no-dynamic-algorithm-selection'() { return require("./rules/no-dynamic-algorithm-selection").noDynamicAlgorithmSelection; },
+    get 'detect-suspicious-dependencies'() { return require("./rules/detect-suspicious-dependencies").detectSuspiciousDependencies; },
+    get 'lock-file'() { return require("./rules/lock-file").lockFile; },
+    get 'no-dynamic-dependency-loading'() { return require("./rules/no-dynamic-dependency-loading").noDynamicDependencyLoading; },
+    get 'require-dependency-integrity'() { return require("./rules/require-dependency-integrity").requireDependencyIntegrity; },
+    get 'require-secure-credential-storage'() { return require("./rules/require-secure-credential-storage").requireSecureCredentialStorage; },
+    get 'require-secure-deletion'() { return require("./rules/require-secure-deletion").requireSecureDeletion; },
+    get 'require-storage-encryption'() { return require("./rules/require-storage-encryption").requireStorageEncryption; },
+    get 'no-dynamic-require'() { return require("./rules/no-dynamic-require").noDynamicRequire; },
+    get 'no-cryptojs'() { return require("./rules/no-cryptojs").noCryptojs; },
+    get 'no-cryptojs-weak-random'() { return require("./rules/no-cryptojs-weak-random").noCryptojsWeakRandom; },
+    get 'no-deprecated-cipher-method'() { return require("./rules/no-deprecated-cipher-method").noDeprecatedCipherMethod; },
+    get 'no-ecb-mode'() { return require("./rules/no-ecb-mode").noEcbMode; },
+    get 'no-insecure-key-derivation'() { return require("./rules/no-insecure-key-derivation").noInsecureKeyDerivation; },
+    get 'no-insecure-rsa-padding'() { return require("./rules/no-insecure-rsa-padding").noInsecureRsaPadding; },
+    get 'no-math-random-crypto'() { return require("./rules/no-math-random-crypto").noMathRandomCrypto; },
+    get 'no-self-signed-certs'() { return require("./rules/no-self-signed-certs").noSelfSignedCerts; },
+    get 'no-sha1-hash'() { return require("./rules/no-sha1-hash").noSha1Hash; },
+    get 'no-static-iv'() { return require("./rules/no-static-iv").noStaticIv; },
+    get 'no-timing-unsafe-compare'() { return require("./rules/no-timing-unsafe-compare").noTimingUnsafeCompare; },
+    get 'no-weak-cipher-algorithm'() { return require("./rules/no-weak-cipher-algorithm").noWeakCipherAlgorithm; },
+    get 'no-weak-hash-algorithm'() { return require("./rules/no-weak-hash-algorithm").noWeakHashAlgorithm; },
+    get 'prefer-native-crypto'() { return require("./rules/prefer-native-crypto").preferNativeCrypto; },
+
 };
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.7.2',
+        version: '4.8.0',
     },
     rules: exports.rules,
 };
 const recommendedRules = {
     'node-security/detect-child-process': 'error',
     'node-security/detect-eval-with-expression': 'error',
-    'node-security/detect-non-literal-fs-filename': 'error',
+    'node-security/detect-non-literal-fs-filename': 'warn',
     'node-security/no-unsafe-dynamic-require': 'error',
     'node-security/no-buffer-overread': 'warn',
     'node-security/no-deprecated-buffer': 'error',

package/src/rules/detect-non-literal-fs-filename/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.generateRefactoringSteps = void 0;
+exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.isFsModule = exports.generateRefactoringSteps = void 0;
+exports.fsMethodName = fsMethodName;
+exports.isFsRequire = isFsRequire;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
 const FS_OPERATIONS = [
@@ -90,6 +92,39 @@ const generateRefactoringSteps = (operation) => {
     }
 };
 exports.generateRefactoringSteps = generateRefactoringSteps;
+const FS_MODULES = new Set(['fs', 'node:fs', 'fs/promises', 'node:fs/promises']);
+const isFsModule = (source) => typeof source === 'string' && FS_MODULES.has(source);
+exports.isFsModule = isFsModule;
+function fsMethodName(callee, namespaces, named) {
+    if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return named.get(callee.name);
+    if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+        callee.computed ||
+        callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+        return undefined;
+    }
+    const object = callee.object;
+    if (object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && namespaces.has(object.name)) {
+        return callee.property.name;
+    }
+    if (object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+        !object.computed &&
+        object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        namespaces.has(object.object.name) &&
+        object.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        object.property.name === 'promises') {
+        return callee.property.name;
+    }
+    return undefined;
+}
+function isFsRequire(node) {
+    return (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        node.callee.name === 'require' &&
+        node.arguments.length > 0 &&
+        node.arguments[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+        (0, exports.isFsModule)(node.arguments[0].value));
+}
 const determineRiskLevel = (operation, pathStr) => {
     if (hasTraversalPatterns(pathStr)) {
         return 'CRITICAL';
@@ -369,14 +404,20 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             }
             return false;
         };
+        const fsNamespaces = new Set(['fs']);
+        const fsNamedMethods = new Map();
+        const pendingCalls = [];
+        function bindFsName(local, imported) {
+            if (imported === 'promises')
+                fsNamespaces.add(local);
+            else
+                fsNamedMethods.set(local, imported);
+        }
         const checkFsCall = (node) => {
-            if (node.callee.type !== 'MemberExpression' ||
-                node.callee.object.type !== 'Identifier' ||
-                node.callee.object.name !== 'fs' ||
-                node.callee.property.type !== 'Identifier') {
+            const methodName = fsMethodName(node.callee, fsNamespaces, fsNamedMethods);
+            if (methodName === undefined) {
                 return;
             }
-            const methodName = node.callee.property.name;
             if (!dangerousMethods.has(methodName)) {
                 return;
             }
@@ -425,7 +466,51 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             });
         };
         return {
-            CallExpression: checkFsCall
+            ImportDeclaration(node) {
+                if (!(0, exports.isFsModule)(node.source.value))
+                    return;
+                for (const spec of node.specifiers) {
+                    if (spec.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier) {
+                        const imported = spec.imported.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
+                            ? spec.imported.name
+                            : spec.imported.value;
+                        bindFsName(spec.local.name, imported);
+                        continue;
+                    }
+                    fsNamespaces.add(spec.local.name);
+                }
+            },
+            VariableDeclarator(node) {
+                if (node.init === null || !isFsRequire(node.init))
+                    return;
+                if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    fsNamespaces.add(node.id.name);
+                    return;
+                }
+                if (node.id.type !== eslint_devkit_1.AST_NODE_TYPES.ObjectPattern)
+                    return;
+                for (const prop of node.id.properties) {
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property || prop.computed)
+                        continue;
+                    if (prop.value.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
+                        continue;
+                    const key = prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
+                        ? prop.key.name
+                        : prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof prop.key.value === 'string'
+                            ? prop.key.value
+                            : undefined;
+                    if (key === undefined)
+                        continue;
+                    bindFsName(prop.value.name, key);
+                }
+            },
+            CallExpression(node) {
+                pendingCalls.push(node);
+            },
+            'Program:exit'() {
+                for (const call of pendingCalls)
+                    checkFsCall(call);
+            },
         };
     },
 });

package/src/rules/lock-file/index.js

@@ -29,7 +29,7 @@ exports.lockFile = (0, eslint_devkit_1.createRule)({
                 properties: {
                     packageManager: {
                         type: 'string',
-                        enum: ['npm', 'yarn', 'pnpm'],
+                        enum: ['npm', 'yarn', 'pnpm'], description: 'Package manager whose lock file is required'
                     },
                 },
                 additionalProperties: false,

package/src/rules/no-buffer-overread/index.js

@@ -132,17 +132,17 @@ exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
                     bufferMethods: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'],
+                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], description: 'Buffer read/write methods checked for bounds'
                     },
                     boundsCheckFunctions: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'],
+                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], description: 'Function names that count as a bounds check'
                     },
                     bufferTypes: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'],
+                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], description: 'Constructor names treated as buffer types'
                     },
                     trustedSanitizers: {
                         type: 'array',

package/src/rules/no-toctou-vulnerability/index.js

@@ -60,7 +60,7 @@ exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
                     fsMethods: {
                         type: 'array',
                         items: { type: 'string' },
-                        default: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'],
+                        default: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'], description: 'Filesystem check calls that create a time-of-check window'
                     },
                 },
                 additionalProperties: false,