eslint-plugin-node-security 4.7.3 → 4.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-security",
-  "version": "4.7.3",
+  "version": "4.8.0",
   "description": "ESLint plugin for Node.js security — detects command injection, path traversal, SSRF, zip slip, and weak crypto (MD5/SHA-1, ECB, static IV) in fs, child_process, vm, and crypto.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -78,7 +78,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.8.0"
+    "@interlace/eslint-devkit": "^1.9.0"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

package/src/index.js

@@ -44,14 +44,14 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-node-security',
-        version: '4.7.3',
+        version: '4.8.0',
     },
     rules: exports.rules,
 };
 const recommendedRules = {
     'node-security/detect-child-process': 'error',
     'node-security/detect-eval-with-expression': 'error',
-    'node-security/detect-non-literal-fs-filename': 'error',
+    'node-security/detect-non-literal-fs-filename': 'warn',
     'node-security/no-unsafe-dynamic-require': 'error',
     'node-security/no-buffer-overread': 'warn',
     'node-security/no-deprecated-buffer': 'error',

package/src/rules/detect-non-literal-fs-filename/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.generateRefactoringSteps = void 0;
+exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.isFsModule = exports.generateRefactoringSteps = void 0;
+exports.fsMethodName = fsMethodName;
+exports.isFsRequire = isFsRequire;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
 const FS_OPERATIONS = [
@@ -90,6 +92,39 @@ const generateRefactoringSteps = (operation) => {
     }
 };
 exports.generateRefactoringSteps = generateRefactoringSteps;
+const FS_MODULES = new Set(['fs', 'node:fs', 'fs/promises', 'node:fs/promises']);
+const isFsModule = (source) => typeof source === 'string' && FS_MODULES.has(source);
+exports.isFsModule = isFsModule;
+function fsMethodName(callee, namespaces, named) {
+    if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return named.get(callee.name);
+    if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
+        callee.computed ||
+        callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+        return undefined;
+    }
+    const object = callee.object;
+    if (object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && namespaces.has(object.name)) {
+        return callee.property.name;
+    }
+    if (object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+        !object.computed &&
+        object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        namespaces.has(object.object.name) &&
+        object.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        object.property.name === 'promises') {
+        return callee.property.name;
+    }
+    return undefined;
+}
+function isFsRequire(node) {
+    return (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+        node.callee.name === 'require' &&
+        node.arguments.length > 0 &&
+        node.arguments[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+        (0, exports.isFsModule)(node.arguments[0].value));
+}
 const determineRiskLevel = (operation, pathStr) => {
     if (hasTraversalPatterns(pathStr)) {
         return 'CRITICAL';
@@ -369,14 +404,20 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             }
             return false;
         };
+        const fsNamespaces = new Set(['fs']);
+        const fsNamedMethods = new Map();
+        const pendingCalls = [];
+        function bindFsName(local, imported) {
+            if (imported === 'promises')
+                fsNamespaces.add(local);
+            else
+                fsNamedMethods.set(local, imported);
+        }
         const checkFsCall = (node) => {
-            if (node.callee.type !== 'MemberExpression' ||
-                node.callee.object.type !== 'Identifier' ||
-                node.callee.object.name !== 'fs' ||
-                node.callee.property.type !== 'Identifier') {
+            const methodName = fsMethodName(node.callee, fsNamespaces, fsNamedMethods);
+            if (methodName === undefined) {
                 return;
             }
-            const methodName = node.callee.property.name;
             if (!dangerousMethods.has(methodName)) {
                 return;
             }
@@ -425,7 +466,51 @@ exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
             });
         };
         return {
-            CallExpression: checkFsCall
+            ImportDeclaration(node) {
+                if (!(0, exports.isFsModule)(node.source.value))
+                    return;
+                for (const spec of node.specifiers) {
+                    if (spec.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier) {
+                        const imported = spec.imported.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
+                            ? spec.imported.name
+                            : spec.imported.value;
+                        bindFsName(spec.local.name, imported);
+                        continue;
+                    }
+                    fsNamespaces.add(spec.local.name);
+                }
+            },
+            VariableDeclarator(node) {
+                if (node.init === null || !isFsRequire(node.init))
+                    return;
+                if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    fsNamespaces.add(node.id.name);
+                    return;
+                }
+                if (node.id.type !== eslint_devkit_1.AST_NODE_TYPES.ObjectPattern)
+                    return;
+                for (const prop of node.id.properties) {
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property || prop.computed)
+                        continue;
+                    if (prop.value.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
+                        continue;
+                    const key = prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
+                        ? prop.key.name
+                        : prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof prop.key.value === 'string'
+                            ? prop.key.value
+                            : undefined;
+                    if (key === undefined)
+                        continue;
+                    bindFsName(prop.value.name, key);
+                }
+            },
+            CallExpression(node) {
+                pendingCalls.push(node);
+            },
+            'Program:exit'() {
+                for (const call of pendingCalls)
+                    checkFsCall(call);
+            },
         };
     },
 });