eslint-plugin-node-security 4.7.3 → 4.8.1

package/src/rules/no-toctou-vulnerability/index.js

@@ -1,195 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noToctouVulnerability = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-exports.noToctouVulnerability = (0, eslint_devkit_2.createRule)({
-    name: 'no-toctou-vulnerability',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-toctou-vulnerability.md',
-            description: 'Detects Time-of-Check-Time-of-Use vulnerabilities',
-            cwe: 'CWE-367',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            toctouVulnerability: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'TOCTOU vulnerability',
-                cwe: 'CWE-367',
-                description: 'Time-of-check Time-of-use race condition detected',
-                severity: 'HIGH',
-                fix: 'Use atomic operations or fs.promises for file operations',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/367.html',
-            }),
-            useAtomicOperations: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Atomic Operations',
-                description: 'Use atomic file operations',
-                severity: 'LOW',
-                fix: 'fs.promises.access() then fs.promises.readFile()',
-                documentationLink: 'https://nodejs.org/api/fs.html#fspromisesaccesspath-mode',
-            }),
-            useFsPromises: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use fs.promises',
-                description: 'Use fs.promises API',
-                severity: 'LOW',
-                fix: 'await fs.promises.readFile() instead of sync operations',
-                documentationLink: 'https://nodejs.org/api/fs.html#promises-api',
-            }),
-            addProperLocking: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Add File Locking',
-                description: 'Add proper locking mechanism',
-                severity: 'LOW',
-                fix: 'Use proper-lockfile or similar for concurrent access',
-                documentationLink: 'https://github.com/moxystudio/node-proper-lockfile',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    ignoreInTests: {
-                        type: 'boolean',
-                        default: true,
-                    },
-                    fsMethods: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'], description: 'Filesystem check calls that create a time-of-check window'
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            ignoreInTests: true,
-            fsMethods: ['fs.existsSync', 'fs.statSync', 'fs.accessSync'],
-        },
-    ],
-    create(context, [options = {}]) {
-        const { ignoreInTests = true } = options || {};
-        const filename = context.filename;
-        const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        if (isTestFile) {
-            return {};
-        }
-        const sourceCode = context.sourceCode;
-        function checkCallExpression(node) {
-            let useMethodName = '';
-            if (node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier') {
-                const objectName = node.callee.object.type === 'Identifier' ? node.callee.object.name : '';
-                if (objectName === 'fs' || objectName === 'fsPromises') {
-                    useMethodName = node.callee.property.name;
-                }
-            }
-            else if (node.callee.type === 'Identifier') {
-                useMethodName = node.callee.name;
-            }
-            const riskyUseMethods = ['readFileSync', 'writeFileSync', 'readFile', 'writeFile', 'openSync', 'open', 'unlinkSync', 'unlink'];
-            if (!riskyUseMethods.includes(useMethodName)) {
-                return;
-            }
-            const useArg = node.arguments[0];
-            if (!useArg)
-                return;
-            let current = node.parent;
-            while (current) {
-                if (current.type === 'IfStatement') {
-                    let condition = current.test;
-                    if (condition.type === 'UnaryExpression' && condition.operator === '!') {
-                        condition = condition.argument;
-                    }
-                    if (condition.type === 'CallExpression') {
-                        let checkMethodName = '';
-                        if (condition.callee.type === 'MemberExpression' && condition.callee.property.type === 'Identifier') {
-                            checkMethodName = condition.callee.property.name;
-                        }
-                        else if (condition.callee.type === 'Identifier') {
-                            checkMethodName = condition.callee.name;
-                        }
-                        const checkMethods = ['existsSync', 'statSync', 'accessSync', 'exists', 'stat', 'access'];
-                        if (checkMethods.includes(checkMethodName)) {
-                            const checkArg = condition.arguments[0];
-                            if (checkArg) {
-                                if (checkArg.type === 'Identifier' && useArg.type === 'Identifier' && checkArg.name === useArg.name) {
-                                    reportToctou(node);
-                                    return;
-                                }
-                                const checkArgText = sourceCode.getText(checkArg).replace(/\s/g, '');
-                                const useArgText = sourceCode.getText(useArg).replace(/\s/g, '');
-                                if (checkArgText === useArgText) {
-                                    reportToctou(node);
-                                    return;
-                                }
-                            }
-                        }
-                        if (condition.callee.type === 'MemberExpression' &&
-                            condition.callee.property.type === 'Identifier' &&
-                            ['isFile', 'isDirectory'].includes(condition.callee.property.name) &&
-                            condition.callee.object.type === 'Identifier') {
-                            const statsVarName = condition.callee.object.name;
-                            let currentScope = sourceCode.getScope(condition);
-                            let variable = null;
-                            while (currentScope) {
-                                variable = currentScope.variables.find(v => v.name === statsVarName) || null;
-                                if (variable)
-                                    break;
-                                currentScope = currentScope.upper;
-                            }
-                            if (variable && variable.defs.length > 0) {
-                                const def = variable.defs[0];
-                                if (def.type === 'Variable' && def.node.init && def.node.init.type === 'CallExpression') {
-                                    const init = def.node.init;
-                                    if (init.callee.type === 'MemberExpression' &&
-                                        init.callee.property.type === 'Identifier' &&
-                                        ['statSync', 'lstatSync', 'stat', 'lstat'].includes(init.callee.property.name)) {
-                                        const statArg = init.arguments[0];
-                                        if (statArg) {
-                                            const checkArgText = sourceCode.getText(statArg).replace(/\s/g, '');
-                                            const useArgText = sourceCode.getText(useArg).replace(/\s/g, '');
-                                            if (checkArgText === useArgText) {
-                                                reportToctou(node);
-                                                return;
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-                current = current.parent;
-            }
-        }
-        function reportToctou(node) {
-            context.report({
-                node,
-                messageId: 'toctouVulnerability',
-                suggest: [
-                    {
-                        messageId: 'useAtomicOperations',
-                        fix: () => null,
-                    },
-                    {
-                        messageId: 'useFsPromises',
-                        fix: () => null,
-                    },
-                    {
-                        messageId: 'addProperLocking',
-                        fix: () => null,
-                    },
-                ],
-            });
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noToctouVulnerability=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");exports.noToctouVulnerability=(0,eslint_devkit_2.createRule)({name:"no-toctou-vulnerability",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-toctou-vulnerability.md",description:"Detects Time-of-Check-Time-of-Use vulnerabilities",cwe:"CWE-367",cvss:7.5},hasSuggestions:true,messages:{toctouVulnerability:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"TOCTOU vulnerability",cwe:"CWE-367",description:"Time-of-check Time-of-use race condition detected",severity:"HIGH",fix:"Use atomic operations or fs.promises for file operations",documentationLink:"https://cwe.mitre.org/data/definitions/367.html"}),useAtomicOperations:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Atomic Operations",description:"Use atomic file operations",severity:"LOW",fix:"fs.promises.access() then fs.promises.readFile()",documentationLink:"https://nodejs.org/api/fs.html#fspromisesaccesspath-mode"}),useFsPromises:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use fs.promises",description:"Use fs.promises API",severity:"LOW",fix:"await fs.promises.readFile() instead of sync operations",documentationLink:"https://nodejs.org/api/fs.html#promises-api"}),addProperLocking:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Add File Locking",description:"Add proper locking mechanism",severity:"LOW",fix:"Use proper-lockfile or similar for concurrent access",documentationLink:"https://github.com/moxystudio/node-proper-lockfile"})},schema:[{type:"object",properties:{ignoreInTests:{type:"boolean",default:true},fsMethods:{type:"array",items:{type:"string"},default:["fs.existsSync","fs.statSync","fs.accessSync"],description:"Filesystem check calls that create a time-of-check window"}},additionalProperties:false}]},defaultOptions:[{ignoreInTests:true,fsMethods:["fs.existsSync","fs.statSync","fs.accessSync"]}],create(context,[options={}]){const{ignoreInTests=true}=options||{};const filename=context.filename;const isTestFile=ignoreInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);if(isTestFile){return{}}const sourceCode=context.sourceCode;function checkCallExpression(node){let useMethodName="";if(node.callee.type==="MemberExpression"&&node.callee.property.type==="Identifier"){const objectName=node.callee.object.type==="Identifier"?node.callee.object.name:"";if(objectName==="fs"||objectName==="fsPromises"){useMethodName=node.callee.property.name}}else if(node.callee.type==="Identifier"){useMethodName=node.callee.name}const riskyUseMethods=["readFileSync","writeFileSync","readFile","writeFile","openSync","open","unlinkSync","unlink"];if(!riskyUseMethods.includes(useMethodName)){return}const useArg=node.arguments[0];if(!useArg)return;let current=node.parent;while(current){if(current.type==="IfStatement"){let condition=current.test;if(condition.type==="UnaryExpression"&&condition.operator==="!"){condition=condition.argument}if(condition.type==="CallExpression"){let checkMethodName="";if(condition.callee.type==="MemberExpression"&&condition.callee.property.type==="Identifier"){checkMethodName=condition.callee.property.name}else if(condition.callee.type==="Identifier"){checkMethodName=condition.callee.name}const checkMethods=["existsSync","statSync","accessSync","exists","stat","access"];if(checkMethods.includes(checkMethodName)){const checkArg=condition.arguments[0];if(checkArg){if(checkArg.type==="Identifier"&&useArg.type==="Identifier"&&checkArg.name===useArg.name){reportToctou(node);return}const checkArgText=sourceCode.getText(checkArg).replace(/\s/g,"");const useArgText=sourceCode.getText(useArg).replace(/\s/g,"");if(checkArgText===useArgText){reportToctou(node);return}}}if(condition.callee.type==="MemberExpression"&&condition.callee.property.type==="Identifier"&&["isFile","isDirectory"].includes(condition.callee.property.name)&&condition.callee.object.type==="Identifier"){const statsVarName=condition.callee.object.name;let currentScope=sourceCode.getScope(condition);let variable=null;while(currentScope){variable=currentScope.variables.find(v=>v.name===statsVarName)||null;if(variable)break;currentScope=currentScope.upper}if(variable&&variable.defs.length>0){const def=variable.defs[0];if(def.type==="Variable"&&def.node.init&&def.node.init.type==="CallExpression"){const init=def.node.init;if(init.callee.type==="MemberExpression"&&init.callee.property.type==="Identifier"&&["statSync","lstatSync","stat","lstat"].includes(init.callee.property.name)){const statArg=init.arguments[0];if(statArg){const checkArgText=sourceCode.getText(statArg).replace(/\s/g,"");const useArgText=sourceCode.getText(useArg).replace(/\s/g,"");if(checkArgText===useArgText){reportToctou(node);return}}}}}}}}current=current.parent}}function reportToctou(node){context.report({node,messageId:"toctouVulnerability",suggest:[{messageId:"useAtomicOperations",fix:()=>null},{messageId:"useFsPromises",fix:()=>null},{messageId:"addProperLocking",fix:()=>null}]})}return{CallExpression:checkCallExpression}}});

package/src/rules/no-unsafe-buffer-alloc/index.js

@@ -1,87 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noUnsafeBufferAlloc = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const UNSAFE_ALLOCATORS = new Set(['allocUnsafe', 'allocUnsafeSlow']);
-exports.noUnsafeBufferAlloc = (0, eslint_devkit_1.createRule)({
-    name: 'no-unsafe-buffer-alloc',
-    meta: {
-        type: 'problem',
-        hasSuggestions: true,
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-buffer-alloc.md',
-            description: 'Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory',
-            cwe: 'CWE-908',
-            cweJustification: 'CWE-908 (Use of Uninitialized Resource) — allocUnsafe returns a view over non-zeroed heap memory; any byte not overwritten before the buffer is read or transmitted discloses prior process memory.',
-            cvss: 7.5,
-            confidence: 'high',
-        },
-        messages: {
-            unsafeAlloc: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Uninitialized Buffer Allocation',
-                cwe: 'CWE-908',
-                cvss: 7.5,
-                description: '`Buffer.allocUnsafe(size)` returns memory that has not been zeroed. Every byte not overwritten before the buffer is read or sent leaks whatever the allocator previously stored there.',
-                severity: 'HIGH',
-                fix: 'Use `Buffer.alloc(size)` (zero-filled), or keep `allocUnsafe` only where the very next statement overwrites the whole buffer — `Buffer.allocUnsafe(size).fill(0)` is accepted by this rule.',
-                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize',
-            }),
-            unsafeAllocSlow: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Uninitialized Buffer Allocation (allocUnsafeSlow)',
-                cwe: 'CWE-908',
-                cvss: 7.5,
-                description: '`Buffer.allocUnsafeSlow(size)` allocates outside the shared pool but is equally uninitialized — the returned bytes are whatever was last in that memory.',
-                severity: 'HIGH',
-                fix: 'Use `Buffer.alloc(size)`, or append `.fill(0)` to zero the allocation at the call site.',
-                documentationLink: 'https://nodejs.org/api/buffer.html#static-method-bufferallocunsafeslowsize',
-            }),
-            useSafeAlloc: 'Replace with `Buffer.alloc()` (zero-filled).',
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        function isFilledInPlace(node) {
-            const parent = node.parent;
-            if (parent?.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
-                parent.object !== node ||
-                parent.computed ||
-                parent.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
-                parent.property.name !== 'fill') {
-                return false;
-            }
-            const grandparent = parent.parent;
-            return (grandparent?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                grandparent.callee === parent);
-        }
-        return {
-            CallExpression(node) {
-                const callee = node.callee;
-                if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
-                    callee.computed ||
-                    callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
-                    callee.object.name !== 'Buffer' ||
-                    callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
-                    !UNSAFE_ALLOCATORS.has(callee.property.name)) {
-                    return;
-                }
-                if (isFilledInPlace(node))
-                    return;
-                context.report({
-                    node,
-                    messageId: callee.property.name === 'allocUnsafe'
-                        ? 'unsafeAlloc'
-                        : 'unsafeAllocSlow',
-                    suggest: [
-                        {
-                            messageId: 'useSafeAlloc',
-                            fix: (fixer) => fixer.replaceText(callee.property, 'alloc'),
-                        },
-                    ],
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noUnsafeBufferAlloc=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const UNSAFE_ALLOCATORS=new Set(["allocUnsafe","allocUnsafeSlow"]);exports.noUnsafeBufferAlloc=(0,eslint_devkit_1.createRule)({name:"no-unsafe-buffer-alloc",meta:{type:"problem",hasSuggestions:true,docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-buffer-alloc.md",description:"Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory",cwe:"CWE-908",cweJustification:"CWE-908 (Use of Uninitialized Resource) \u2014 allocUnsafe returns a view over non-zeroed heap memory; any byte not overwritten before the buffer is read or transmitted discloses prior process memory.",cvss:7.5,confidence:"high"},messages:{unsafeAlloc:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Uninitialized Buffer Allocation",cwe:"CWE-908",cvss:7.5,description:"`Buffer.allocUnsafe(size)` returns memory that has not been zeroed. Every byte not overwritten before the buffer is read or sent leaks whatever the allocator previously stored there.",severity:"HIGH",fix:"Use `Buffer.alloc(size)` (zero-filled), or keep `allocUnsafe` only where the very next statement overwrites the whole buffer \u2014 `Buffer.allocUnsafe(size).fill(0)` is accepted by this rule.",documentationLink:"https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize"}),unsafeAllocSlow:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Uninitialized Buffer Allocation (allocUnsafeSlow)",cwe:"CWE-908",cvss:7.5,description:"`Buffer.allocUnsafeSlow(size)` allocates outside the shared pool but is equally uninitialized \u2014 the returned bytes are whatever was last in that memory.",severity:"HIGH",fix:"Use `Buffer.alloc(size)`, or append `.fill(0)` to zero the allocation at the call site.",documentationLink:"https://nodejs.org/api/buffer.html#static-method-bufferallocunsafeslowsize"}),useSafeAlloc:"Replace with `Buffer.alloc()` (zero-filled)."},schema:[]},defaultOptions:[],create(context){function isFilledInPlace(node){const parent=node.parent;if(parent?.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression||parent.object!==node||parent.computed||parent.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier||parent.property.name!=="fill"){return false}const grandparent=parent.parent;return grandparent?.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&grandparent.callee===parent}return{CallExpression(node){const callee=node.callee;if(callee.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression||callee.computed||callee.object.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier||callee.object.name!=="Buffer"||callee.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier||!UNSAFE_ALLOCATORS.has(callee.property.name)){return}if(isFilledInPlace(node))return;context.report({node,messageId:callee.property.name==="allocUnsafe"?"unsafeAlloc":"unsafeAllocSlow",suggest:[{messageId:"useSafeAlloc",fix:fixer=>fixer.replaceText(callee.property,"alloc")}]})}}}});

package/src/rules/no-unsafe-dynamic-require/index.js

@@ -1,93 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noUnsafeDynamicRequire = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-exports.noUnsafeDynamicRequire = (0, eslint_devkit_2.createRule)({
-    name: 'no-unsafe-dynamic-require',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-dynamic-require.md',
-            description: 'Prevent unsafe dynamic require() calls that could enable code injection',
-            cwe: 'CWE-95',
-            cvss: 9.8,
-        },
-        hasSuggestions: false,
-        messages: {
-            unsafeDynamicRequire: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Dynamic require()',
-                cwe: 'CWE-95',
-                description: 'Dynamic require() detected',
-                severity: 'CRITICAL',
-                fix: 'Use allowlist: const ALLOWED = ["mod1", "mod2"]; if (!ALLOWED.includes(name)) throw Error("Not allowed")',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowDynamicImport: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowDynamicImport: false,
-        },
-    ],
-    create(context) {
-        const requireVariables = new Set();
-        const isRequireReference = (node) => {
-            if (node.type === 'Identifier' && node.name === 'require') {
-                return true;
-            }
-            if (node.type === 'Identifier' && requireVariables.has(node.name)) {
-                return true;
-            }
-            return false;
-        };
-        const isDynamicArgument = (arg) => {
-            if (arg.type === 'Literal')
-                return false;
-            if (arg.type === 'TemplateLiteral' && arg.expressions.length === 0)
-                return false;
-            return true;
-        };
-        return {
-            VariableDeclarator(node) {
-                if (node.id.type === 'Identifier' && node.init) {
-                    if (node.init.type === 'Identifier' && node.init.name === 'require') {
-                        requireVariables.add(node.id.name);
-                    }
-                }
-            },
-            CallExpression(node) {
-                if (node.callee.type !== 'Identifier') {
-                    return;
-                }
-                if (!isRequireReference(node.callee)) {
-                    return;
-                }
-                if (node.arguments.length === 0)
-                    return;
-                const firstArg = node.arguments[0];
-                if (firstArg.type === 'SpreadElement')
-                    return;
-                if (!isDynamicArgument(firstArg))
-                    return;
-                context.report({
-                    node,
-                    messageId: 'unsafeDynamicRequire',
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noUnsafeDynamicRequire=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");exports.noUnsafeDynamicRequire=(0,eslint_devkit_2.createRule)({name:"no-unsafe-dynamic-require",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-unsafe-dynamic-require.md",description:"Prevent unsafe dynamic require() calls that could enable code injection",cwe:"CWE-95",cvss:9.8},hasSuggestions:false,messages:{unsafeDynamicRequire:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Dynamic require()",cwe:"CWE-95",description:"Dynamic require() detected",severity:"CRITICAL",fix:'Use allowlist: const ALLOWED = ["mod1", "mod2"]; if (!ALLOWED.includes(name)) throw Error("Not allowed")',documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"})},schema:[{type:"object",properties:{allowDynamicImport:{type:"boolean",default:false}},additionalProperties:false}]},defaultOptions:[{allowDynamicImport:false}],create(context){const requireVariables=new Set;const isRequireReference=node=>{if(node.type==="Identifier"&&node.name==="require"){return true}if(node.type==="Identifier"&&requireVariables.has(node.name)){return true}return false};const isDynamicArgument=arg=>{if(arg.type==="Literal")return false;if(arg.type==="TemplateLiteral"&&arg.expressions.length===0)return false;return true};return{VariableDeclarator(node){if(node.id.type==="Identifier"&&node.init){if(node.init.type==="Identifier"&&node.init.name==="require"){requireVariables.add(node.id.name)}}},CallExpression(node){if(node.callee.type!=="Identifier"){return}if(!isRequireReference(node.callee)){return}if(node.arguments.length===0)return;const firstArg=node.arguments[0];if(firstArg.type==="SpreadElement")return;if(!isDynamicArgument(firstArg))return;context.report({node,messageId:"unsafeDynamicRequire"})}}}});

package/src/rules/no-weak-cipher-algorithm/index.js

@@ -1,174 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noWeakCipherAlgorithm = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const WEAK_CIPHER_PATTERNS = [
-    {
-        pattern: /\bdes\b(?!-ede)/i,
-        name: 'DES',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-    {
-        pattern: /\bdes-ede3?\b|\b3des\b|\btripledes\b/i,
-        name: '3DES',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-    {
-        pattern: /\brc4\b|\barc4\b/i,
-        name: 'RC4',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-    {
-        pattern: /\bblowfish\b|\bbf\b/i,
-        name: 'Blowfish',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-    {
-        pattern: /\brc2\b/i,
-        name: 'RC2',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-    {
-        pattern: /\bidea\b/i,
-        name: 'IDEA',
-        alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-        replacement: 'aes-256-gcm',
-    },
-];
-function findWeakCipher(value, additionalPatterns) {
-    for (const pattern of WEAK_CIPHER_PATTERNS) {
-        if (pattern.pattern.test(value)) {
-            return pattern;
-        }
-    }
-    for (const additionalPattern of additionalPatterns) {
-        const regex = new RegExp(`\\b${additionalPattern}\\b`, 'i');
-        if (regex.test(value)) {
-            return {
-                pattern: regex,
-                name: additionalPattern.toUpperCase(),
-                alternatives: ['AES-256-GCM', 'ChaCha20-Poly1305'],
-                replacement: 'aes-256-gcm',
-            };
-        }
-    }
-    return null;
-}
-exports.noWeakCipherAlgorithm = (0, eslint_devkit_1.createRule)({
-    name: 'no-weak-cipher-algorithm',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-cipher-algorithm.md',
-            description: 'Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            weakCipherAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Weak cipher algorithm',
-                cwe: 'CWE-327',
-                description: 'Use of weak cipher algorithm: {{algorithm}}. {{algorithm}} has known vulnerabilities and should not be used.',
-                severity: 'CRITICAL',
-                fix: 'Replace with {{replacement}}: crypto.createCipheriv("{{replacement}}", key, iv)',
-                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
-            }),
-            useAes256Gcm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use AES-256-GCM',
-                description: 'Replace with AES-256-GCM for authenticated encryption',
-                severity: 'LOW',
-                fix: 'crypto.createCipheriv("aes-256-gcm", key, iv)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-            useChaCha20: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use ChaCha20-Poly1305',
-                description: 'Replace with ChaCha20-Poly1305 for modern encryption',
-                severity: 'LOW',
-                fix: 'crypto.createCipheriv("chacha20-poly1305", key, iv)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    additionalWeakCiphers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional weak ciphers to detect',
-                    },
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow weak ciphers in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            additionalWeakCiphers: [],
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { additionalWeakCiphers = [], allowInTests = false, } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            const cipherMethods = new Set(['createCipher', 'createCipheriv', 'createDecipher', 'createDecipheriv']);
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                cipherMethods.has(node.callee.property.name)) {
-                checkCipherArgument(node);
-            }
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                cipherMethods.has(node.callee.name)) {
-                checkCipherArgument(node);
-            }
-        }
-        function checkCipherArgument(node) {
-            const firstArg = node.arguments[0];
-            if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string') {
-                const weakPattern = findWeakCipher(firstArg.value, additionalWeakCiphers);
-                if (weakPattern) {
-                    context.report({
-                        node: firstArg,
-                        messageId: 'weakCipherAlgorithm',
-                        data: {
-                            algorithm: weakPattern.name,
-                            replacement: weakPattern.replacement,
-                        },
-                        suggest: [
-                            {
-                                messageId: 'useAes256Gcm',
-                                fix: (fixer) => fixer.replaceText(firstArg, `"aes-256-gcm"`),
-                            },
-                            {
-                                messageId: 'useChaCha20',
-                                fix: (fixer) => fixer.replaceText(firstArg, `"chacha20-poly1305"`),
-                            },
-                        ],
-                    });
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noWeakCipherAlgorithm=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const WEAK_CIPHER_PATTERNS=[{pattern:/\bdes\b(?!-ede)/i,name:"DES",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"},{pattern:/\bdes-ede3?\b|\b3des\b|\btripledes\b/i,name:"3DES",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"},{pattern:/\brc4\b|\barc4\b/i,name:"RC4",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"},{pattern:/\bblowfish\b|\bbf\b/i,name:"Blowfish",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"},{pattern:/\brc2\b/i,name:"RC2",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"},{pattern:/\bidea\b/i,name:"IDEA",alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"}];function findWeakCipher(value,additionalPatterns){for(const pattern of WEAK_CIPHER_PATTERNS){if(pattern.pattern.test(value)){return pattern}}for(const additionalPattern of additionalPatterns){const regex=new RegExp(`\\b${additionalPattern}\\b`,"i");if(regex.test(value)){return{pattern:regex,name:additionalPattern.toUpperCase(),alternatives:["AES-256-GCM","ChaCha20-Poly1305"],replacement:"aes-256-gcm"}}}return null}exports.noWeakCipherAlgorithm=(0,eslint_devkit_1.createRule)({name:"no-weak-cipher-algorithm",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-cipher-algorithm.md",description:"Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{weakCipherAlgorithm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Weak cipher algorithm",cwe:"CWE-327",description:"Use of weak cipher algorithm: {{algorithm}}. {{algorithm}} has known vulnerabilities and should not be used.",severity:"CRITICAL",fix:'Replace with {{replacement}}: crypto.createCipheriv("{{replacement}}", key, iv)',documentationLink:"https://owasp.org/www-community/vulnerabilities/Weak_Cryptography"}),useAes256Gcm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use AES-256-GCM",description:"Replace with AES-256-GCM for authenticated encryption",severity:"LOW",fix:'crypto.createCipheriv("aes-256-gcm", key, iv)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"}),useChaCha20:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use ChaCha20-Poly1305",description:"Replace with ChaCha20-Poly1305 for modern encryption",severity:"LOW",fix:'crypto.createCipheriv("chacha20-poly1305", key, iv)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"})},schema:[{type:"object",properties:{additionalWeakCiphers:{type:"array",items:{type:"string"},default:[],description:"Additional weak ciphers to detect"},allowInTests:{type:"boolean",default:false,description:"Allow weak ciphers in test files"}},additionalProperties:false}]},defaultOptions:[{additionalWeakCiphers:[],allowInTests:false}],create(context,[options={}]){const{additionalWeakCiphers=[],allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkCallExpression(node){if(isTestFile)return;const cipherMethods=new Set(["createCipher","createCipheriv","createDecipher","createDecipheriv"]);if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&cipherMethods.has(node.callee.property.name)){checkCipherArgument(node)}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&cipherMethods.has(node.callee.name)){checkCipherArgument(node)}}function checkCipherArgument(node){const firstArg=node.arguments[0];if(firstArg?.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof firstArg.value==="string"){const weakPattern=findWeakCipher(firstArg.value,additionalWeakCiphers);if(weakPattern){context.report({node:firstArg,messageId:"weakCipherAlgorithm",data:{algorithm:weakPattern.name,replacement:weakPattern.replacement},suggest:[{messageId:"useAes256Gcm",fix:fixer=>fixer.replaceText(firstArg,`"aes-256-gcm"`)},{messageId:"useChaCha20",fix:fixer=>fixer.replaceText(firstArg,`"chacha20-poly1305"`)}]})}}}return{CallExpression:checkCallExpression}}});