eslint-plugin-node-security 4.7.3 → 4.8.1

package/src/rules/no-weak-hash-algorithm/index.js

@@ -1,199 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noWeakHashAlgorithm = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const WEAK_HASH_PATTERNS = [
-    {
-        pattern: /\bmd5\b/i,
-        name: 'MD5',
-        alternatives: ['SHA-256', 'SHA-512', 'SHA-3'],
-        replacement: 'sha256',
-    },
-    {
-        pattern: /\bmd4\b/i,
-        name: 'MD4',
-        alternatives: ['SHA-256', 'SHA-512', 'SHA-3'],
-        replacement: 'sha256',
-    },
-    {
-        pattern: /\bsha1\b/i,
-        name: 'SHA-1',
-        alternatives: ['SHA-256', 'SHA-512', 'SHA-3'],
-        replacement: 'sha256',
-    },
-    {
-        pattern: /\bripemd\b/i,
-        name: 'RIPEMD',
-        alternatives: ['SHA-256', 'SHA-512'],
-        replacement: 'sha256',
-    },
-];
-function findWeakHash(value, additionalPatterns) {
-    for (const pattern of WEAK_HASH_PATTERNS) {
-        if (pattern.pattern.test(value)) {
-            return pattern;
-        }
-    }
-    for (const additionalPattern of additionalPatterns) {
-        const regex = new RegExp(`\\b${additionalPattern}\\b`, 'i');
-        if (regex.test(value)) {
-            return {
-                pattern: regex,
-                name: additionalPattern.toUpperCase(),
-                alternatives: ['SHA-256', 'SHA-512'],
-                replacement: 'sha256',
-            };
-        }
-    }
-    return null;
-}
-exports.noWeakHashAlgorithm = (0, eslint_devkit_1.createRule)({
-    name: 'no-weak-hash-algorithm',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-hash-algorithm.md',
-            description: 'Disallow weak hash algorithms (MD5, SHA1, MD4)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            weakHashAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Weak hash algorithm',
-                cwe: 'CWE-327',
-                description: 'Use of weak hash algorithm: {{algorithm}}. {{algorithm}} is cryptographically broken and unsuitable for security purposes.',
-                severity: 'CRITICAL',
-                fix: 'Replace with {{replacement}}: crypto.createHash("{{replacement}}").update(data)',
-                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
-            }),
-            useSha256: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use SHA-256',
-                description: 'Replace with SHA-256 for secure hashing',
-                severity: 'LOW',
-                fix: 'crypto.createHash("sha256").update(data)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options',
-            }),
-            useSha512: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use SHA-512',
-                description: 'Replace with SHA-512 for stronger hashing',
-                severity: 'LOW',
-                fix: 'crypto.createHash("sha512").update(data)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options',
-            }),
-            useSha3: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use SHA-3',
-                description: 'Replace with SHA-3 for latest standard',
-                severity: 'LOW',
-                fix: 'crypto.createHash("sha3-256").update(data)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    additionalWeakAlgorithms: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional weak algorithms to detect',
-                    },
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow weak hashes in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            additionalWeakAlgorithms: [],
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { additionalWeakAlgorithms = [], allowInTests = false, } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.callee.property.name === 'createHash') {
-                checkHashArgument(node);
-            }
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.callee.name === 'createHash') {
-                checkHashArgument(node);
-            }
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                const funcName = node.callee.name.toLowerCase();
-                if (funcName === 'sha1' || funcName === 'md5' || funcName === 'md4') {
-                    const weakPattern = findWeakHash(funcName, additionalWeakAlgorithms);
-                    context.report({
-                        node,
-                        messageId: 'weakHashAlgorithm',
-                        data: {
-                            algorithm: weakPattern.name,
-                            replacement: weakPattern.replacement,
-                        },
-                        suggest: [
-                            {
-                                messageId: 'useSha256',
-                                fix: (fixer) => {
-                                    if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                                        return fixer.replaceText(node.callee, 'sha256');
-                                    }
-                                    return null;
-                                },
-                            },
-                        ],
-                    });
-                }
-            }
-        }
-        function checkHashArgument(node) {
-            for (const arg of node.arguments) {
-                if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof arg.value === 'string') {
-                    const weakPattern = findWeakHash(arg.value, additionalWeakAlgorithms);
-                    if (weakPattern) {
-                        context.report({
-                            node: arg,
-                            messageId: 'weakHashAlgorithm',
-                            data: {
-                                algorithm: weakPattern.name,
-                                replacement: weakPattern.replacement,
-                            },
-                            suggest: [
-                                {
-                                    messageId: 'useSha256',
-                                    fix: (fixer) => fixer.replaceText(arg, `"sha256"`),
-                                },
-                                {
-                                    messageId: 'useSha512',
-                                    fix: (fixer) => fixer.replaceText(arg, `"sha512"`),
-                                },
-                                {
-                                    messageId: 'useSha3',
-                                    fix: (fixer) => fixer.replaceText(arg, `"sha3-256"`),
-                                },
-                            ],
-                        });
-                    }
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noWeakHashAlgorithm=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const WEAK_HASH_PATTERNS=[{pattern:/\bmd5\b/i,name:"MD5",alternatives:["SHA-256","SHA-512","SHA-3"],replacement:"sha256"},{pattern:/\bmd4\b/i,name:"MD4",alternatives:["SHA-256","SHA-512","SHA-3"],replacement:"sha256"},{pattern:/\bsha1\b/i,name:"SHA-1",alternatives:["SHA-256","SHA-512","SHA-3"],replacement:"sha256"},{pattern:/\bripemd\b/i,name:"RIPEMD",alternatives:["SHA-256","SHA-512"],replacement:"sha256"}];function findWeakHash(value,additionalPatterns){for(const pattern of WEAK_HASH_PATTERNS){if(pattern.pattern.test(value)){return pattern}}for(const additionalPattern of additionalPatterns){const regex=new RegExp(`\\b${additionalPattern}\\b`,"i");if(regex.test(value)){return{pattern:regex,name:additionalPattern.toUpperCase(),alternatives:["SHA-256","SHA-512"],replacement:"sha256"}}}return null}exports.noWeakHashAlgorithm=(0,eslint_devkit_1.createRule)({name:"no-weak-hash-algorithm",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-weak-hash-algorithm.md",description:"Disallow weak hash algorithms (MD5, SHA1, MD4)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{weakHashAlgorithm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Weak hash algorithm",cwe:"CWE-327",description:"Use of weak hash algorithm: {{algorithm}}. {{algorithm}} is cryptographically broken and unsuitable for security purposes.",severity:"CRITICAL",fix:'Replace with {{replacement}}: crypto.createHash("{{replacement}}").update(data)',documentationLink:"https://owasp.org/www-community/vulnerabilities/Weak_Cryptography"}),useSha256:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use SHA-256",description:"Replace with SHA-256 for secure hashing",severity:"LOW",fix:'crypto.createHash("sha256").update(data)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options"}),useSha512:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use SHA-512",description:"Replace with SHA-512 for stronger hashing",severity:"LOW",fix:'crypto.createHash("sha512").update(data)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options"}),useSha3:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use SHA-3",description:"Replace with SHA-3 for latest standard",severity:"LOW",fix:'crypto.createHash("sha3-256").update(data)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options"})},schema:[{type:"object",properties:{additionalWeakAlgorithms:{type:"array",items:{type:"string"},default:[],description:"Additional weak algorithms to detect"},allowInTests:{type:"boolean",default:false,description:"Allow weak hashes in test files"}},additionalProperties:false}]},defaultOptions:[{additionalWeakAlgorithms:[],allowInTests:false}],create(context,[options={}]){const{additionalWeakAlgorithms=[],allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkCallExpression(node){if(isTestFile)return;if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.property.name==="createHash"){checkHashArgument(node)}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="createHash"){checkHashArgument(node)}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const funcName=node.callee.name.toLowerCase();if(funcName==="sha1"||funcName==="md5"||funcName==="md4"){const weakPattern=findWeakHash(funcName,additionalWeakAlgorithms);context.report({node,messageId:"weakHashAlgorithm",data:{algorithm:weakPattern.name,replacement:weakPattern.replacement},suggest:[{messageId:"useSha256",fix:fixer=>{if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){return fixer.replaceText(node.callee,"sha256")}return null}}]})}}}function checkHashArgument(node){for(const arg of node.arguments){if(arg.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof arg.value==="string"){const weakPattern=findWeakHash(arg.value,additionalWeakAlgorithms);if(weakPattern){context.report({node:arg,messageId:"weakHashAlgorithm",data:{algorithm:weakPattern.name,replacement:weakPattern.replacement},suggest:[{messageId:"useSha256",fix:fixer=>fixer.replaceText(arg,`"sha256"`)},{messageId:"useSha512",fix:fixer=>fixer.replaceText(arg,`"sha512"`)},{messageId:"useSha3",fix:fixer=>fixer.replaceText(arg,`"sha3-256"`)}]})}}}}return{CallExpression:checkCallExpression}}});

package/src/rules/no-zip-slip/index.js

@@ -1,410 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noZipSlip = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const containsPathTraversal = (pathText) => {
-    return /\.\.\//.test(pathText) ||
-        /\.\.\\/.test(pathText) ||
-        pathText.startsWith('..') ||
-        /\/\.\./.test(pathText);
-};
-const isDangerousDestination = (destText) => {
-    if (destText.startsWith('/tmp') || destText.includes('os.tmpdir') || destText.includes('TMPDIR')) {
-        return false;
-    }
-    return destText.includes('/var') ||
-        destText.includes('/usr') ||
-        destText.includes('/etc') ||
-        destText.includes('/root') ||
-        destText.includes('/home') ||
-        destText.includes('C:\\Windows') ||
-        destText.includes('C:\\Program Files') ||
-        destText.includes('C:\\Users');
-};
-exports.noZipSlip = (0, eslint_devkit_1.createRule)({
-    name: 'no-zip-slip',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-zip-slip.md',
-            description: 'Detects zip slip/archive extraction vulnerabilities',
-            cwe: 'CWE-22',
-        },
-        hasSuggestions: true,
-        messages: {
-            zipSlipVulnerability: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Zip Slip Vulnerability',
-                cwe: 'CWE-22',
-                description: 'Archive extraction vulnerable to path traversal',
-                severity: '{{severity}}',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            }),
-            unsafeArchiveExtraction: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Unsafe Archive Extraction',
-                cwe: 'CWE-22',
-                description: 'Archive extraction without path validation',
-                severity: 'HIGH',
-                fix: 'Use safe extraction libraries or validate all paths',
-                documentationLink: 'https://snyk.io/research/zip-slip-vulnerability',
-            }),
-            pathTraversalInArchive: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Path Traversal in Archive',
-                cwe: 'CWE-22',
-                description: 'Archive contains path traversal sequences',
-                severity: 'CRITICAL',
-                fix: 'Reject archives with path traversal or sanitize paths',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            }),
-            unvalidatedArchivePath: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Unvalidated Archive Path',
-                cwe: 'CWE-22',
-                description: 'Archive entry path used without validation',
-                severity: 'HIGH',
-                fix: 'Validate paths before extraction',
-                documentationLink: 'https://snyk.io/research/zip-slip-vulnerability',
-            }),
-            dangerousArchiveDestination: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Dangerous Archive Destination',
-                cwe: 'CWE-22',
-                description: 'Archive extracted to sensitive location',
-                severity: 'MEDIUM',
-                fix: 'Extract to safe temporary directory',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            }),
-            useSafeArchiveExtraction: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Use Safe Archive Extraction',
-                description: 'Use libraries with built-in path validation',
-                severity: 'LOW',
-                fix: 'Use yauzl, safe-archive-extract, or similar safe libraries',
-                documentationLink: 'https://www.npmjs.com/package/yauzl',
-            }),
-            validateArchivePaths: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Validate Archive Paths',
-                description: 'Validate all archive entry paths',
-                severity: 'LOW',
-                fix: 'Check paths don\'t contain ../ and are within destination directory',
-                documentationLink: 'https://snyk.io/research/zip-slip-vulnerability',
-            }),
-            sanitizeArchiveNames: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Sanitize Archive Names',
-                description: 'Sanitize archive entry names',
-                severity: 'LOW',
-                fix: 'Use path.basename() or custom sanitization',
-                documentationLink: 'https://nodejs.org/api/path.html#pathbasenamepath-ext',
-            }),
-            strategyPathValidation: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Path Validation Strategy',
-                description: 'Validate paths before any file operations',
-                severity: 'LOW',
-                fix: 'Check path.startsWith(destination) and no ../ sequences',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            }),
-            strategySafeLibraries: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Safe Libraries Strategy',
-                description: 'Use archive libraries with built-in safety',
-                severity: 'LOW',
-                fix: 'Use yauzl, adm-zip with validation, or safe-archive-extract',
-                documentationLink: 'https://www.npmjs.com/package/safe-archive-extract',
-            }),
-            strategySandboxing: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Sandboxing Strategy',
-                description: 'Extract archives in sandboxed environment',
-                severity: 'LOW',
-                fix: 'Use temporary directories and restrict permissions',
-                documentationLink: 'https://nodejs.org/api/fs.html#fsopentempdirprefix-options-callback',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    archiveFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['extract', 'extractAll', 'extractAllTo', 'unzip', 'untar', 'extractArchive'],
-                    },
-                    pathValidationFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['validatePath', 'sanitizePath', 'checkPath', 'safePath'],
-                    },
-                    safeLibraries: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['yauzl', 'safe-archive-extract', 'tar-stream', 'unzipper'],
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            archiveFunctions: ['extract', 'extractAll', 'extractAllTo', 'unzip', 'untar', 'extractArchive'],
-            pathValidationFunctions: ['validatePath', 'sanitizePath', 'checkPath', 'safePath'],
-            safeLibraries: ['yauzl', 'safe-archive-extract', 'tar-stream', 'unzipper'],
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { archiveFunctions = ['extract', 'extractAll', 'extractAllTo', 'unzip', 'untar', 'extractArchive'], pathValidationFunctions = ['validatePath', 'sanitizePath', 'checkPath', 'safePath'], safeLibraries = ['yauzl', 'safe-archive-extract', 'tar-stream', 'unzipper'], } = options;
-        const filename = context.filename;
-        const isArchiveExtraction = (node) => {
-            const callee = node.callee;
-            if (callee.type === 'MemberExpression' &&
-                callee.property.type === 'Identifier' &&
-                archiveFunctions.includes(callee.property.name)) {
-                return true;
-            }
-            if (callee.type === 'Identifier' &&
-                archiveFunctions.includes(callee.name)) {
-                return true;
-            }
-            return false;
-        };
-        const isPathValidated = (pathNode) => {
-            let current = pathNode;
-            while (current) {
-                if (current.type === 'CallExpression' &&
-                    current.callee.type === 'Identifier' &&
-                    pathValidationFunctions.includes(current.callee.name)) {
-                    return true;
-                }
-                if (current.type === 'CallExpression' &&
-                    current.callee.type === 'MemberExpression' &&
-                    current.callee.object.type === 'Identifier' &&
-                    current.callee.object.name === 'path' &&
-                    current.callee.property.type === 'Identifier' &&
-                    current.callee.property.name === 'basename') {
-                    return true;
-                }
-                if (current.type === 'IfStatement') {
-                    const test = current.test;
-                    if (test.type === 'CallExpression' &&
-                        test.callee.type === 'MemberExpression' &&
-                        test.callee.property.type === 'Identifier' &&
-                        test.callee.property.name === 'startsWith') {
-                        return true;
-                    }
-                    if (test.type === 'UnaryExpression' && test.operator === '!' &&
-                        test.argument.type === 'CallExpression' &&
-                        test.argument.callee.type === 'MemberExpression' &&
-                        test.argument.callee.property.type === 'Identifier' &&
-                        test.argument.callee.property.name === 'startsWith') {
-                        return true;
-                    }
-                    if (test.type === 'CallExpression' &&
-                        test.callee.type === 'MemberExpression' &&
-                        test.callee.property.type === 'Identifier' &&
-                        test.callee.property.name === 'includes') {
-                        return true;
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        };
-        const isSafeLibrary = (node) => {
-            const callee = node.callee;
-            if (callee.type === 'MemberExpression' &&
-                callee.object.type === 'Identifier' &&
-                safeLibraries.includes(callee.object.name)) {
-                return true;
-            }
-            if (callee.type === 'Identifier') {
-                const name = callee.name.toLowerCase();
-                if (name === 'extract' || name === 'unzipper' ||
-                    safeLibraries.some(lib => name.includes(lib.toLowerCase()))) {
-                    return true;
-                }
-            }
-            return false;
-        };
-        return {
-            CallExpression(node) {
-                if (isArchiveExtraction(node) && !isSafeLibrary(node)) {
-                    const sourceCode = context.sourceCode;
-                    let hasSafeAnnotation = false;
-                    const allComments = sourceCode.getAllComments();
-                    for (const comment of allComments) {
-                        if (comment.type === 'Block' && comment.value.includes('@safe')) {
-                            hasSafeAnnotation = true;
-                            break;
-                        }
-                    }
-                    if (hasSafeAnnotation) {
-                        return;
-                    }
-                    const args = node.arguments;
-                    let destArg;
-                    if (node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier') {
-                        const methodName = node.callee.property.name;
-                        if (['extractAllTo', 'unzip'].includes(methodName)) {
-                            destArg = args[0];
-                        }
-                        else {
-                            destArg = args.length >= 2 ? args[1] : undefined;
-                        }
-                    }
-                    else {
-                        destArg = args.length >= 2 ? args[1] : undefined;
-                    }
-                    const destText = destArg && destArg.type === 'Literal' && typeof destArg.value === 'string' ? destArg.value : '';
-                    const isDestDangerous = isDangerousDestination(destText);
-                    const isMethodCall = node.callee.type === 'MemberExpression';
-                    if (isMethodCall) {
-                        const isSafeRelativePath = destText.startsWith('./') || destText.startsWith('../');
-                        if (!isSafeRelativePath) {
-                            context.report({
-                                node,
-                                messageId: 'unsafeArchiveExtraction',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                                suggest: [
-                                    {
-                                        messageId: 'useSafeArchiveExtraction',
-                                        fix: () => null,
-                                    },
-                                ],
-                            });
-                        }
-                        if (isDestDangerous && destArg) {
-                            context.report({
-                                node: destArg,
-                                messageId: 'dangerousArchiveDestination',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                    else {
-                        if (isDestDangerous) {
-                            context.report({
-                                node,
-                                messageId: 'dangerousArchiveDestination',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                        else {
-                            context.report({
-                                node,
-                                messageId: 'unsafeArchiveExtraction',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                                suggest: [
-                                    {
-                                        messageId: 'useSafeArchiveExtraction',
-                                        fix: () => null
-                                    },
-                                ],
-                            });
-                        }
-                    }
-                }
-                const callee = node.callee;
-                if (callee.type === 'MemberExpression' &&
-                    callee.property.type === 'Identifier' &&
-                    ['join', 'resolve', 'relative', 'normalize'].includes(callee.property.name)) {
-                    const args = node.arguments;
-                    for (const arg of args) {
-                        if (arg.type === 'MemberExpression' &&
-                            arg.property.type === 'Identifier' &&
-                            ['name', 'path', 'fileName', 'entryName', 'relativePath', 'filename', 'pathname'].includes(arg.property.name)) {
-                            if (!isPathValidated(arg)) {
-                                context.report({
-                                    node: arg,
-                                    messageId: 'unvalidatedArchivePath',
-                                    data: {
-                                        filePath: filename,
-                                        line: String(node.loc?.start.line ?? 0),
-                                    },
-                                });
-                            }
-                        }
-                    }
-                }
-            },
-            Literal(node) {
-                if (typeof node.value !== 'string') {
-                    return;
-                }
-                const text = node.value;
-                if ((text.includes('/') || text.includes('\\')) && containsPathTraversal(text)) {
-                    let current = node;
-                    let isArchiveContext = false;
-                    while (current) {
-                        if (current.type === 'CallExpression' && isArchiveExtraction(current)) {
-                            isArchiveContext = true;
-                            break;
-                        }
-                        if (current.type === 'VariableDeclarator' &&
-                            current.id.type === 'Identifier' &&
-                            (current.id.name.includes('archive') ||
-                                current.id.name.includes('zip') ||
-                                current.id.name.includes('tar') ||
-                                current.id.name.includes('path') ||
-                                current.id.name.includes('file') ||
-                                current.id.name.includes('entry'))) {
-                            isArchiveContext = true;
-                            break;
-                        }
-                        current = current.parent;
-                    }
-                    const parent = node.parent;
-                    if (parent && parent.type === 'VariableDeclarator' && parent.id.type === 'Identifier') {
-                        const varName = parent.id.name.toLowerCase();
-                        if (varName.includes('archive') || varName.includes('zip') || varName.includes('tar') ||
-                            varName.includes('path') || varName.includes('file') || varName.includes('extract') ||
-                            varName.includes('entry')) {
-                            isArchiveContext = true;
-                        }
-                    }
-                    if (isArchiveContext) {
-                        context.report({
-                            node,
-                            messageId: 'pathTraversalInArchive',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                }
-            },
-            VariableDeclarator(node) {
-                if (!node.init || node.id.type !== 'Identifier') {
-                    return;
-                }
-                const varName = node.id.name.toLowerCase();
-                if (varName.includes('entry') || varName.includes('file') || varName.includes('path')) {
-                    if (node.init.type === 'MemberExpression' &&
-                        node.init.property.type === 'Identifier' &&
-                        ['name', 'path'].includes(node.init.property.name)) {
-                    }
-                }
-            }
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noZipSlip=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const containsPathTraversal=pathText=>{return/\.\.\//.test(pathText)||/\.\.\\/.test(pathText)||pathText.startsWith("..")||/\/\.\./.test(pathText)};const isDangerousDestination=destText=>{if(destText.startsWith("/tmp")||destText.includes("os.tmpdir")||destText.includes("TMPDIR")){return false}return destText.includes("/var")||destText.includes("/usr")||destText.includes("/etc")||destText.includes("/root")||destText.includes("/home")||destText.includes("C:\\Windows")||destText.includes("C:\\Program Files")||destText.includes("C:\\Users")};exports.noZipSlip=(0,eslint_devkit_1.createRule)({name:"no-zip-slip",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-zip-slip.md",description:"Detects zip slip/archive extraction vulnerabilities",cwe:"CWE-22"},hasSuggestions:true,messages:{zipSlipVulnerability:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.SECURITY,issueName:"Zip Slip Vulnerability",cwe:"CWE-22",description:"Archive extraction vulnerable to path traversal",severity:"{{severity}}",fix:"{{safeAlternative}}",documentationLink:"https://cwe.mitre.org/data/definitions/22.html"}),unsafeArchiveExtraction:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.SECURITY,issueName:"Unsafe Archive Extraction",cwe:"CWE-22",description:"Archive extraction without path validation",severity:"HIGH",fix:"Use safe extraction libraries or validate all paths",documentationLink:"https://snyk.io/research/zip-slip-vulnerability"}),pathTraversalInArchive:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.SECURITY,issueName:"Path Traversal in Archive",cwe:"CWE-22",description:"Archive contains path traversal sequences",severity:"CRITICAL",fix:"Reject archives with path traversal or sanitize paths",documentationLink:"https://cwe.mitre.org/data/definitions/22.html"}),unvalidatedArchivePath:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.SECURITY,issueName:"Unvalidated Archive Path",cwe:"CWE-22",description:"Archive entry path used without validation",severity:"HIGH",fix:"Validate paths before extraction",documentationLink:"https://snyk.io/research/zip-slip-vulnerability"}),dangerousArchiveDestination:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.SECURITY,issueName:"Dangerous Archive Destination",cwe:"CWE-22",description:"Archive extracted to sensitive location",severity:"MEDIUM",fix:"Extract to safe temporary directory",documentationLink:"https://cwe.mitre.org/data/definitions/22.html"}),useSafeArchiveExtraction:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.INFO,issueName:"Use Safe Archive Extraction",description:"Use libraries with built-in path validation",severity:"LOW",fix:"Use yauzl, safe-archive-extract, or similar safe libraries",documentationLink:"https://www.npmjs.com/package/yauzl"}),validateArchivePaths:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.INFO,issueName:"Validate Archive Paths",description:"Validate all archive entry paths",severity:"LOW",fix:"Check paths don't contain ../ and are within destination directory",documentationLink:"https://snyk.io/research/zip-slip-vulnerability"}),sanitizeArchiveNames:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.INFO,issueName:"Sanitize Archive Names",description:"Sanitize archive entry names",severity:"LOW",fix:"Use path.basename() or custom sanitization",documentationLink:"https://nodejs.org/api/path.html#pathbasenamepath-ext"}),strategyPathValidation:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.STRATEGY,issueName:"Path Validation Strategy",description:"Validate paths before any file operations",severity:"LOW",fix:"Check path.startsWith(destination) and no ../ sequences",documentationLink:"https://cwe.mitre.org/data/definitions/22.html"}),strategySafeLibraries:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.STRATEGY,issueName:"Safe Libraries Strategy",description:"Use archive libraries with built-in safety",severity:"LOW",fix:"Use yauzl, adm-zip with validation, or safe-archive-extract",documentationLink:"https://www.npmjs.com/package/safe-archive-extract"}),strategySandboxing:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.STRATEGY,issueName:"Sandboxing Strategy",description:"Extract archives in sandboxed environment",severity:"LOW",fix:"Use temporary directories and restrict permissions",documentationLink:"https://nodejs.org/api/fs.html#fsopentempdirprefix-options-callback"})},schema:[{type:"object",properties:{archiveFunctions:{type:"array",items:{type:"string"},default:["extract","extractAll","extractAllTo","unzip","untar","extractArchive"]},pathValidationFunctions:{type:"array",items:{type:"string"},default:["validatePath","sanitizePath","checkPath","safePath"]},safeLibraries:{type:"array",items:{type:"string"},default:["yauzl","safe-archive-extract","tar-stream","unzipper"]}},additionalProperties:false}]},defaultOptions:[{archiveFunctions:["extract","extractAll","extractAllTo","unzip","untar","extractArchive"],pathValidationFunctions:["validatePath","sanitizePath","checkPath","safePath"],safeLibraries:["yauzl","safe-archive-extract","tar-stream","unzipper"]}],create(context){const options=context.options[0]||{};const{archiveFunctions=["extract","extractAll","extractAllTo","unzip","untar","extractArchive"],pathValidationFunctions=["validatePath","sanitizePath","checkPath","safePath"],safeLibraries=["yauzl","safe-archive-extract","tar-stream","unzipper"]}=options;const filename=context.filename;const isArchiveExtraction=node=>{const callee=node.callee;if(callee.type==="MemberExpression"&&callee.property.type==="Identifier"&&archiveFunctions.includes(callee.property.name)){return true}if(callee.type==="Identifier"&&archiveFunctions.includes(callee.name)){return true}return false};const isPathValidated=pathNode=>{let current=pathNode;while(current){if(current.type==="CallExpression"&&current.callee.type==="Identifier"&&pathValidationFunctions.includes(current.callee.name)){return true}if(current.type==="CallExpression"&&current.callee.type==="MemberExpression"&&current.callee.object.type==="Identifier"&&current.callee.object.name==="path"&&current.callee.property.type==="Identifier"&&current.callee.property.name==="basename"){return true}if(current.type==="IfStatement"){const test=current.test;if(test.type==="CallExpression"&&test.callee.type==="MemberExpression"&&test.callee.property.type==="Identifier"&&test.callee.property.name==="startsWith"){return true}if(test.type==="UnaryExpression"&&test.operator==="!"&&test.argument.type==="CallExpression"&&test.argument.callee.type==="MemberExpression"&&test.argument.callee.property.type==="Identifier"&&test.argument.callee.property.name==="startsWith"){return true}if(test.type==="CallExpression"&&test.callee.type==="MemberExpression"&&test.callee.property.type==="Identifier"&&test.callee.property.name==="includes"){return true}}current=current.parent}return false};const isSafeLibrary=node=>{const callee=node.callee;if(callee.type==="MemberExpression"&&callee.object.type==="Identifier"&&safeLibraries.includes(callee.object.name)){return true}if(callee.type==="Identifier"){const name=callee.name.toLowerCase();if(name==="extract"||name==="unzipper"||safeLibraries.some(lib=>name.includes(lib.toLowerCase()))){return true}}return false};return{CallExpression(node){if(isArchiveExtraction(node)&&!isSafeLibrary(node)){const sourceCode=context.sourceCode;let hasSafeAnnotation=false;const allComments=sourceCode.getAllComments();for(const comment of allComments){if(comment.type==="Block"&&comment.value.includes("@safe")){hasSafeAnnotation=true;break}}if(hasSafeAnnotation){return}const args=node.arguments;let destArg;if(node.callee.type==="MemberExpression"&&node.callee.property.type==="Identifier"){const methodName=node.callee.property.name;if(["extractAllTo","unzip"].includes(methodName)){destArg=args[0]}else{destArg=args.length>=2?args[1]:void 0}}else{destArg=args.length>=2?args[1]:void 0}const destText=destArg&&destArg.type==="Literal"&&typeof destArg.value==="string"?destArg.value:"";const isDestDangerous=isDangerousDestination(destText);const isMethodCall=node.callee.type==="MemberExpression";if(isMethodCall){const isSafeRelativePath=destText.startsWith("./")||destText.startsWith("../");if(!isSafeRelativePath){context.report({node,messageId:"unsafeArchiveExtraction",data:{filePath:filename,line:String(node.loc?.start.line??0)},suggest:[{messageId:"useSafeArchiveExtraction",fix:()=>null}]})}if(isDestDangerous&&destArg){context.report({node:destArg,messageId:"dangerousArchiveDestination",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}else{if(isDestDangerous){context.report({node,messageId:"dangerousArchiveDestination",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}else{context.report({node,messageId:"unsafeArchiveExtraction",data:{filePath:filename,line:String(node.loc?.start.line??0)},suggest:[{messageId:"useSafeArchiveExtraction",fix:()=>null}]})}}}const callee=node.callee;if(callee.type==="MemberExpression"&&callee.property.type==="Identifier"&&["join","resolve","relative","normalize"].includes(callee.property.name)){const args=node.arguments;for(const arg of args){if(arg.type==="MemberExpression"&&arg.property.type==="Identifier"&&["name","path","fileName","entryName","relativePath","filename","pathname"].includes(arg.property.name)){if(!isPathValidated(arg)){context.report({node:arg,messageId:"unvalidatedArchivePath",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}}}},Literal(node){if(typeof node.value!=="string"){return}const text=node.value;if((text.includes("/")||text.includes("\\"))&&containsPathTraversal(text)){let current=node;let isArchiveContext=false;while(current){if(current.type==="CallExpression"&&isArchiveExtraction(current)){isArchiveContext=true;break}if(current.type==="VariableDeclarator"&&current.id.type==="Identifier"&&(current.id.name.includes("archive")||current.id.name.includes("zip")||current.id.name.includes("tar")||current.id.name.includes("path")||current.id.name.includes("file")||current.id.name.includes("entry"))){isArchiveContext=true;break}current=current.parent}const parent=node.parent;if(parent&&parent.type==="VariableDeclarator"&&parent.id.type==="Identifier"){const varName=parent.id.name.toLowerCase();if(varName.includes("archive")||varName.includes("zip")||varName.includes("tar")||varName.includes("path")||varName.includes("file")||varName.includes("extract")||varName.includes("entry")){isArchiveContext=true}}if(isArchiveContext){context.report({node,messageId:"pathTraversalInArchive",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}},VariableDeclarator(node){if(!node.init||node.id.type!=="Identifier"){return}const varName=node.id.name.toLowerCase();if(varName.includes("entry")||varName.includes("file")||varName.includes("path")){if(node.init.type==="MemberExpression"&&node.init.property.type==="Identifier"&&["name","path"].includes(node.init.property.name)){}}}}}});