eslint-plugin-node-security 4.7.3 → 4.8.1

package/src/rules/detect-child-process/index.js

@@ -1,625 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectChildProcess = exports.generateRefactoringSteps = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const COMMAND_PATTERNS = [
-    {
-        method: 'exec',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['execFile', 'spawn'],
-        example: {
-            bad: 'exec(`git clone ${repoUrl}`)',
-            good: [
-                'execFile(\'git\', [\'clone\', repoUrl], {shell: false})',
-                'spawn(\'git\', [\'clone\', repoUrl], {shell: false})'
-            ]
-        },
-        effort: '15-25 minutes'
-    },
-    {
-        method: 'execSync',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['execFileSync', 'spawnSync'],
-        example: {
-            bad: 'execSync(`npm install ${packageName}`)',
-            good: [
-                'execFileSync(\'npm\', [\'install\', packageName], {shell: false})',
-                'spawnSync(\'npm\', [\'install\', packageName], {shell: false})'
-            ]
-        },
-        effort: '15-25 minutes'
-    },
-    {
-        method: 'spawn',
-        dangerous: false,
-        vulnerability: 'argument-injection',
-        safeAlternatives: ['spawn with validation'],
-        example: {
-            bad: 'spawn(\'bash\', [\'-c\', userCommand])',
-            good: [
-                'spawn(validatedCommand, validatedArgs, {shell: false})',
-                '// Validate command and args first'
-            ]
-        },
-        effort: '20-30 minutes'
-    },
-    {
-        method: 'execFile',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['spawn'],
-        example: {
-            bad: 'execFile(userCommand, userArgs, callback)',
-            good: [
-                'spawn(validatedCommand, validatedArgs, {shell: false})',
-                '// Validate command and args first'
-            ]
-        },
-        effort: '10-15 minutes'
-    },
-    {
-        method: 'execFileSync',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['spawnSync'],
-        example: {
-            bad: 'execFileSync(userCommand, userArgs)',
-            good: [
-                'spawnSync(validatedCommand, validatedArgs, {shell: false})',
-                '// Validate command and args first'
-            ]
-        },
-        effort: '10-15 minutes'
-    },
-    {
-        method: 'spawnSync',
-        dangerous: false,
-        vulnerability: 'argument-injection',
-        safeAlternatives: ['spawnSync with validation'],
-        example: {
-            bad: 'spawnSync(\'bash\', [\'-c\', userCommand])',
-            good: [
-                'spawnSync(validatedCommand, validatedArgs, {shell: false})',
-                '// Validate command and args first'
-            ]
-        },
-        effort: '15-20 minutes'
-    },
-    {
-        method: 'fork',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['spawn'],
-        example: {
-            bad: 'fork(userScript)',
-            good: [
-                'spawn(\'node\', [validatedScript], {shell: false})',
-                '// Validate script path first'
-            ]
-        },
-        effort: '15-20 minutes'
-    },
-    {
-        method: 'forkSync',
-        dangerous: true,
-        vulnerability: 'command-injection',
-        safeAlternatives: ['spawnSync'],
-        example: {
-            bad: 'forkSync(userScript)',
-            good: [
-                'spawnSync(\'node\', [validatedScript], {shell: false, stdio: \'inherit\'})',
-                '// Validate script path first'
-            ]
-        },
-        effort: '15-20 minutes'
-    }
-];
-const generateRefactoringSteps = (pattern) => {
-    switch (pattern.method) {
-        case 'exec':
-        case 'execSync':
-            return [
-                '   1. Replace exec() with execFile() or spawn()',
-                '   2. Split command and arguments into separate array elements',
-                '   3. Use {shell: false} option to prevent shell interpretation',
-                '   4. Validate and sanitize all user inputs',
-                '   5. Consider using execa library for better security'
-            ].join('\n');
-        case 'spawn':
-            return [
-                '   1. Ensure first argument is a safe, validated command path',
-                '   2. Pass arguments as separate array elements',
-                '   3. Use {shell: false} to prevent shell injection',
-                '   4. Validate command exists and is executable',
-                '   5. Consider using cross-spawn for cross-platform safety'
-            ].join('\n');
-        case 'execFile':
-            return [
-                '   1. Replace execFile() with spawn() for better security',
-                '   2. Validate command path before execution',
-                '   3. Ensure arguments are properly sanitized',
-                '   4. Use {shell: false} option',
-                '   5. Consider using execa library'
-            ].join('\n');
-        case 'execFileSync':
-            return [
-                '   1. Replace execFileSync() with spawnSync() for better security',
-                '   2. Validate command path before execution',
-                '   3. Ensure arguments are properly sanitized',
-                '   4. Use {shell: false} option',
-                '   5. Consider using execa library'
-            ].join('\n');
-        case 'spawnSync':
-            return [
-                '   1. Ensure first argument is a safe, validated command path',
-                '   2. Pass arguments as separate array elements',
-                '   3. Use {shell: false} to prevent shell injection',
-                '   4. Validate command exists and is executable',
-                '   5. Handle synchronous execution properly'
-            ].join('\n');
-        case 'fork':
-            return [
-                '   1. Replace fork() with spawn() for Node.js scripts',
-                '   2. Validate script path exists and is readable',
-                '   3. Use spawn(\'node\', [scriptPath], options) instead',
-                '   4. Add proper error handling',
-                '   5. Consider using child_process.execFile() for simple scripts'
-            ].join('\n');
-        case 'forkSync':
-            return [
-                '   1. Replace forkSync() with spawnSync() for Node.js scripts',
-                '   2. Validate script path exists and is readable',
-                '   3. Use spawnSync(\'node\', [scriptPath], options) instead',
-                '   4. Add proper error handling and synchronous waiting',
-                '   5. Consider using child_process.execFileSync() for simple scripts'
-            ].join('\n');
-        default:
-            return [
-                '   1. Identify the specific command execution need',
-                '   2. Choose appropriate child_process method',
-                '   3. Use argument arrays instead of string interpolation',
-                '   4. Add comprehensive input validation',
-                '   5. Test with malicious inputs'
-            ].join('\n');
-    }
-};
-exports.generateRefactoringSteps = generateRefactoringSteps;
-exports.detectChildProcess = (0, eslint_devkit_2.createRule)({
-    name: 'detect-child-process',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-child-process.md',
-            description: 'Detects child_process usage that may allow command injection',
-            cwe: 'CWE-78',
-            cvss: 9.8,
-            confidence: 'medium',
-        },
-        messages: {
-            childProcessCommandInjection: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.WARNING,
-                issueName: 'Command injection',
-                cwe: 'CWE-78',
-                description: 'Command injection detected',
-                severity: 'CRITICAL',
-                fix: 'Use execFile/spawn with {shell: false} and array args',
-                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
-            }),
-            useExecFile: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use execFile',
-                description: 'Use execFile() with argument array',
-                severity: 'LOW',
-                fix: 'execFile(cmd, [arg1, arg2], { shell: false })',
-                documentationLink: 'https://nodejs.org/api/child_process.html#child_processexecfilefile-args-options-callback',
-            }),
-            useSpawn: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use spawn',
-                description: 'Use spawn() with separate arguments',
-                severity: 'LOW',
-                fix: 'spawn(cmd, [arg1, arg2], { shell: false })',
-                documentationLink: 'https://nodejs.org/api/child_process.html#child_processspawncommand-args-options',
-            }),
-            useSaferLibrary: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Safer Library',
-                description: 'Consider safer command execution libraries',
-                severity: 'LOW',
-                fix: 'Use execa, zx, or cross-spawn instead',
-                documentationLink: 'https://github.com/sindresorhus/execa',
-            }),
-            validateInput: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Validate Input',
-                description: 'Add input validation and sanitization',
-                severity: 'LOW',
-                fix: 'Validate user input before passing to command',
-                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
-            }),
-            useShellFalse: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Disable Shell',
-                description: 'Use shell: false option',
-                severity: 'LOW',
-                fix: '{ shell: false } to prevent shell interpretation',
-                documentationLink: 'https://nodejs.org/api/child_process.html#spawning-bat-and-cmd-files-on-windows',
-            }),
-            strategyValidate: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Validate Strategy',
-                description: 'Comprehensive input validation',
-                severity: 'LOW',
-                fix: 'Add allowlist validation before command execution',
-                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
-            }),
-            strategySanitize: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Sanitize Strategy',
-                description: 'Sanitize and escape command arguments',
-                severity: 'LOW',
-                fix: 'Escape special characters in command arguments',
-                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
-            }),
-            strategyRestrict: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Restrict Strategy',
-                description: 'Restrict to predefined safe commands',
-                severity: 'LOW',
-                fix: 'Define allowlist of permitted commands',
-                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowLiteralStrings: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow exec() with literal strings'
-                    },
-                    allowLiteralSpawn: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow spawn() with literal arguments'
-                    },
-                    additionalMethods: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional child_process methods to check'
-                    },
-                    strategy: {
-                        type: 'string',
-                        enum: ['validate', 'sanitize', 'restrict', 'auto'],
-                        default: 'auto',
-                        description: 'Strategy for fixing command injection (auto = smart detection)'
-                    }
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowLiteralStrings: false,
-            allowLiteralSpawn: false,
-            additionalMethods: [],
-            strategy: 'auto'
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { allowLiteralStrings = false, allowLiteralSpawn = false, additionalMethods = [], } = options;
-        const dangerousMethodsSet = new Set([
-            'exec',
-            'execSync',
-            'execFile',
-            'execFileSync',
-            'spawn',
-            'spawnSync',
-            'fork',
-            'forkSync',
-            ...additionalMethods
-        ]);
-        const moduleAliases = new Set(['child_process']);
-        const importedMethods = new Set();
-        const containsDynamicStrings = (node) => {
-            if (node.type === 'TemplateLiteral') {
-                return node.expressions.length > 0;
-            }
-            if (node.type === 'BinaryExpression' && node.operator === '+') {
-                return true;
-            }
-            if (node.type === 'Identifier') {
-                return true;
-            }
-            return false;
-        };
-        const hasOnlyLiteralArgs = (args) => {
-            if (args.length === 0)
-                return false;
-            const command = args[0];
-            if (command.type !== 'Literal' || typeof command.value !== 'string') {
-                return false;
-            }
-            if (args.length >= 2) {
-                const argsArray = args[1];
-                if (argsArray.type === 'ArrayExpression') {
-                    const allLiteralElements = argsArray.elements.every((el) => el?.type === 'Literal' && typeof el.value === 'string');
-                    if (!allLiteralElements) {
-                        return false;
-                    }
-                }
-                else if (argsArray.type !== 'Literal') {
-                    return false;
-                }
-            }
-            return true;
-        };
-        const hasShellFalseOption = (node) => {
-            const optionsArg = node.arguments[2];
-            if (!optionsArg || optionsArg.type !== eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
-                return true;
-            }
-            for (const prop of optionsArg.properties) {
-                if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
-                    prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    prop.key.name === 'shell') {
-                    if (prop.value.type === eslint_devkit_1.AST_NODE_TYPES.Literal && prop.value.value === false) {
-                        return true;
-                    }
-                    return false;
-                }
-            }
-            return true;
-        };
-        const hasPrecedingAllowlistValidation = (node) => {
-            const makeArgChecker = (validatedVarNames) => {
-                const check = (argNode) => {
-                    if (argNode.type === 'Identifier' && validatedVarNames.has(argNode.name))
-                        return true;
-                    if (argNode.type === 'TemplateLiteral') {
-                        return argNode.expressions.some(e => e.type === 'Identifier' && validatedVarNames.has(e.name));
-                    }
-                    if (argNode.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression) {
-                        return argNode.elements.some(el => el !== null && check(el));
-                    }
-                    return false;
-                };
-                return check;
-            };
-            const checkGuardClause = (ifNode) => {
-                const test = ifNode.test;
-                if (test.type === 'CallExpression' &&
-                    test.callee.type === 'MemberExpression' &&
-                    test.callee.property.type === 'Identifier' &&
-                    test.callee.property.name === 'includes') {
-                    const validatedVarNames = new Set();
-                    for (const testArg of test.arguments) {
-                        if (testArg.type === 'Identifier')
-                            validatedVarNames.add(testArg.name);
-                    }
-                    const check = makeArgChecker(validatedVarNames);
-                    for (const arg of node.arguments) {
-                        if (check(arg))
-                            return true;
-                    }
-                }
-                if (test.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression && test.operator === '!' &&
-                    test.argument.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                    test.argument.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    test.argument.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    test.argument.callee.property.name === 'includes') {
-                    const consequent = ifNode.consequent;
-                    const isGuardBody = (consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement ||
-                        consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement ||
-                        (consequent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement &&
-                            consequent.body.length > 0 &&
-                            (consequent.body[0].type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement ||
-                                consequent.body[0].type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement)));
-                    if (isGuardBody) {
-                        const validatedVarNames = new Set();
-                        for (const testArg of test.argument.arguments) {
-                            if (testArg.type === 'Identifier')
-                                validatedVarNames.add(testArg.name);
-                        }
-                        const check = makeArgChecker(validatedVarNames.size > 0 ? validatedVarNames : new Set(['*']));
-                        if (validatedVarNames.size > 0) {
-                            for (const arg of node.arguments) {
-                                if (check(arg))
-                                    return true;
-                            }
-                        }
-                        else {
-                            for (const arg of node.arguments) {
-                                if (arg.type === 'Identifier' ||
-                                    (arg.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression && arg.elements.some(el => el?.type === 'Identifier'))) {
-                                    return true;
-                                }
-                            }
-                        }
-                    }
-                }
-                return false;
-            };
-            let current = node.parent;
-            while (current) {
-                if (current.type === 'IfStatement') {
-                    if (checkGuardClause(current))
-                        return true;
-                }
-                current = current.parent;
-            }
-            let stmt = node.parent;
-            while (stmt && stmt.parent && stmt.parent.type !== eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
-                stmt = stmt.parent;
-            }
-            if (stmt && stmt.parent && stmt.parent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
-                const block = stmt.parent;
-                const callIndex = block.body.indexOf(stmt);
-                if (callIndex > 0) {
-                    for (let i = 0; i < callIndex; i++) {
-                        const sibling = block.body[i];
-                        if (sibling.type === 'IfStatement') {
-                            if (checkGuardClause(sibling))
-                                return true;
-                        }
-                    }
-                }
-            }
-            return false;
-        };
-        const extractCommandInfo = (node, method) => {
-            const sourceCode = context.sourceCode;
-            const args = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
-            const pattern = COMMAND_PATTERNS.find(p => p.method === method) || null;
-            const isDynamic = node.arguments.some((arg) => containsDynamicStrings(arg));
-            return { args, pattern, isDynamic };
-        };
-        const determineRiskLevel = (pattern, isDynamic) => {
-            if (pattern?.dangerous && isDynamic) {
-                return 'critical';
-            }
-            if (pattern?.dangerous || isDynamic) {
-                return 'high';
-            }
-            return 'medium';
-        };
-        const getChildProcessCall = (node) => {
-            if (node.callee.type === 'MemberExpression' &&
-                node.callee.property.type === 'Identifier') {
-                const methodName = node.callee.property.name;
-                if (!dangerousMethodsSet.has(methodName)) {
-                    return null;
-                }
-                if (node.callee.object.type === 'Identifier' &&
-                    moduleAliases.has(node.callee.object.name)) {
-                    return { method: methodName, calleeNode: node.callee };
-                }
-            }
-            if (node.callee.type === 'Identifier' && dangerousMethodsSet.has(node.callee.name)) {
-                if (importedMethods.has(node.callee.name)) {
-                    return { method: node.callee.name, calleeNode: node.callee };
-                }
-            }
-            return null;
-        };
-        const checkChildProcessCall = (node) => {
-            const detected = getChildProcessCall(node);
-            if (!detected) {
-                return;
-            }
-            const { method } = detected;
-            const { args, pattern, isDynamic } = extractCommandInfo(node, method);
-            if ((method === 'exec' || method === 'execSync') && !isDynamic && hasOnlyLiteralArgs(node.arguments)) {
-                return;
-            }
-            if (allowLiteralStrings && method === 'exec' && !isDynamic) {
-                return;
-            }
-            const saferMethods = new Set(['spawn', 'spawnSync', 'execFile', 'execFileSync']);
-            if (allowLiteralSpawn && saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
-                return;
-            }
-            if (saferMethods.has(method) && hasOnlyLiteralArgs(node.arguments)) {
-                const isExecFile = method === 'execFile' || method === 'execFileSync';
-                if (isExecFile || hasShellFalseOption(node)) {
-                    return;
-                }
-            }
-            const allSafeMethods = ['execFile', 'execFileSync', 'spawn', 'spawnSync'];
-            if (allSafeMethods.includes(method) && hasPrecedingAllowlistValidation(node)) {
-                return;
-            }
-            const riskLevel = determineRiskLevel(pattern, isDynamic);
-            const steps = pattern ? (0, exports.generateRefactoringSteps)(pattern) : 'Review and secure command execution';
-            const alternatives = pattern?.safeAlternatives.join(', ') || 'execFile, spawn with validation';
-            context.report({
-                node,
-                messageId: 'childProcessCommandInjection',
-                data: {
-                    method,
-                    args,
-                    riskLevel,
-                    vulnerability: pattern?.vulnerability || 'command injection',
-                    alternatives,
-                    steps,
-                    effort: pattern?.effort || '15-30 minutes'
-                },
-                suggest: [
-                    {
-                        messageId: 'useExecFile',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'useSpawn',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'useSaferLibrary',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'validateInput',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'useShellFalse',
-                        fix: () => null
-                    }
-                ]
-            });
-        };
-        const trackChildProcessImport = (node) => {
-            if (node.source.value !== 'child_process') {
-                return;
-            }
-            for (const specifier of node.specifiers) {
-                if (specifier.type === 'ImportDefaultSpecifier' || specifier.type === 'ImportNamespaceSpecifier') {
-                    moduleAliases.add(specifier.local.name);
-                }
-                if (specifier.type === 'ImportSpecifier') {
-                    importedMethods.add(specifier.local.name);
-                }
-            }
-        };
-        const trackChildProcessRequire = (node) => {
-            if (!node.init) {
-                return;
-            }
-            if (node.id.type === 'Identifier' &&
-                node.init.type === 'CallExpression' &&
-                node.init.callee.type === 'Identifier' &&
-                node.init.callee.name === 'require' &&
-                node.init.arguments[0] &&
-                node.init.arguments[0].type === 'Literal' &&
-                node.init.arguments[0].value === 'child_process') {
-                moduleAliases.add(node.id.name);
-                return;
-            }
-            if (node.id.type === 'ObjectPattern' &&
-                node.init?.type === 'CallExpression' &&
-                node.init.callee.type === 'Identifier' &&
-                node.init.callee.name === 'require' &&
-                node.init.arguments[0] &&
-                node.init.arguments[0].type === 'Literal' &&
-                node.init.arguments[0].value === 'child_process') {
-                for (const prop of node.id.properties) {
-                    if (prop.type === 'Property' && prop.key.type === 'Identifier') {
-                        importedMethods.add(prop.value.type === 'Identifier' ? prop.value.name : prop.key.name);
-                    }
-                }
-            }
-        };
-        return {
-            CallExpression: checkChildProcessCall,
-            ImportDeclaration: trackChildProcessImport,
-            VariableDeclarator: trackChildProcessRequire
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.detectChildProcess=exports.generateRefactoringSteps=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const COMMAND_PATTERNS=[{method:"exec",dangerous:true,vulnerability:"command-injection",safeAlternatives:["execFile","spawn"],example:{bad:"exec(`git clone ${repoUrl}`)",good:["execFile('git', ['clone', repoUrl], {shell: false})","spawn('git', ['clone', repoUrl], {shell: false})"]},effort:"15-25 minutes"},{method:"execSync",dangerous:true,vulnerability:"command-injection",safeAlternatives:["execFileSync","spawnSync"],example:{bad:"execSync(`npm install ${packageName}`)",good:["execFileSync('npm', ['install', packageName], {shell: false})","spawnSync('npm', ['install', packageName], {shell: false})"]},effort:"15-25 minutes"},{method:"spawn",dangerous:false,vulnerability:"argument-injection",safeAlternatives:["spawn with validation"],example:{bad:"spawn('bash', ['-c', userCommand])",good:["spawn(validatedCommand, validatedArgs, {shell: false})","// Validate command and args first"]},effort:"20-30 minutes"},{method:"execFile",dangerous:true,vulnerability:"command-injection",safeAlternatives:["spawn"],example:{bad:"execFile(userCommand, userArgs, callback)",good:["spawn(validatedCommand, validatedArgs, {shell: false})","// Validate command and args first"]},effort:"10-15 minutes"},{method:"execFileSync",dangerous:true,vulnerability:"command-injection",safeAlternatives:["spawnSync"],example:{bad:"execFileSync(userCommand, userArgs)",good:["spawnSync(validatedCommand, validatedArgs, {shell: false})","// Validate command and args first"]},effort:"10-15 minutes"},{method:"spawnSync",dangerous:false,vulnerability:"argument-injection",safeAlternatives:["spawnSync with validation"],example:{bad:"spawnSync('bash', ['-c', userCommand])",good:["spawnSync(validatedCommand, validatedArgs, {shell: false})","// Validate command and args first"]},effort:"15-20 minutes"},{method:"fork",dangerous:true,vulnerability:"command-injection",safeAlternatives:["spawn"],example:{bad:"fork(userScript)",good:["spawn('node', [validatedScript], {shell: false})","// Validate script path first"]},effort:"15-20 minutes"},{method:"forkSync",dangerous:true,vulnerability:"command-injection",safeAlternatives:["spawnSync"],example:{bad:"forkSync(userScript)",good:["spawnSync('node', [validatedScript], {shell: false, stdio: 'inherit'})","// Validate script path first"]},effort:"15-20 minutes"}];const generateRefactoringSteps=pattern=>{switch(pattern.method){case"exec":case"execSync":return["   1. Replace exec() with execFile() or spawn()","   2. Split command and arguments into separate array elements","   3. Use {shell: false} option to prevent shell interpretation","   4. Validate and sanitize all user inputs","   5. Consider using execa library for better security"].join("\n");case"spawn":return["   1. Ensure first argument is a safe, validated command path","   2. Pass arguments as separate array elements","   3. Use {shell: false} to prevent shell injection","   4. Validate command exists and is executable","   5. Consider using cross-spawn for cross-platform safety"].join("\n");case"execFile":return["   1. Replace execFile() with spawn() for better security","   2. Validate command path before execution","   3. Ensure arguments are properly sanitized","   4. Use {shell: false} option","   5. Consider using execa library"].join("\n");case"execFileSync":return["   1. Replace execFileSync() with spawnSync() for better security","   2. Validate command path before execution","   3. Ensure arguments are properly sanitized","   4. Use {shell: false} option","   5. Consider using execa library"].join("\n");case"spawnSync":return["   1. Ensure first argument is a safe, validated command path","   2. Pass arguments as separate array elements","   3. Use {shell: false} to prevent shell injection","   4. Validate command exists and is executable","   5. Handle synchronous execution properly"].join("\n");case"fork":return["   1. Replace fork() with spawn() for Node.js scripts","   2. Validate script path exists and is readable","   3. Use spawn('node', [scriptPath], options) instead","   4. Add proper error handling","   5. Consider using child_process.execFile() for simple scripts"].join("\n");case"forkSync":return["   1. Replace forkSync() with spawnSync() for Node.js scripts","   2. Validate script path exists and is readable","   3. Use spawnSync('node', [scriptPath], options) instead","   4. Add proper error handling and synchronous waiting","   5. Consider using child_process.execFileSync() for simple scripts"].join("\n");default:return["   1. Identify the specific command execution need","   2. Choose appropriate child_process method","   3. Use argument arrays instead of string interpolation","   4. Add comprehensive input validation","   5. Test with malicious inputs"].join("\n")}};exports.generateRefactoringSteps=generateRefactoringSteps;exports.detectChildProcess=(0,eslint_devkit_2.createRule)({name:"detect-child-process",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-child-process.md",description:"Detects child_process usage that may allow command injection",cwe:"CWE-78",cvss:9.8,confidence:"medium"},messages:{childProcessCommandInjection:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.WARNING,issueName:"Command injection",cwe:"CWE-78",description:"Command injection detected",severity:"CRITICAL",fix:"Use execFile/spawn with {shell: false} and array args",documentationLink:"https://owasp.org/www-community/attacks/Command_Injection"}),useExecFile:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use execFile",description:"Use execFile() with argument array",severity:"LOW",fix:"execFile(cmd, [arg1, arg2], { shell: false })",documentationLink:"https://nodejs.org/api/child_process.html#child_processexecfilefile-args-options-callback"}),useSpawn:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use spawn",description:"Use spawn() with separate arguments",severity:"LOW",fix:"spawn(cmd, [arg1, arg2], { shell: false })",documentationLink:"https://nodejs.org/api/child_process.html#child_processspawncommand-args-options"}),useSaferLibrary:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Safer Library",description:"Consider safer command execution libraries",severity:"LOW",fix:"Use execa, zx, or cross-spawn instead",documentationLink:"https://github.com/sindresorhus/execa"}),validateInput:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Validate Input",description:"Add input validation and sanitization",severity:"LOW",fix:"Validate user input before passing to command",documentationLink:"https://owasp.org/www-community/attacks/Command_Injection"}),useShellFalse:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Disable Shell",description:"Use shell: false option",severity:"LOW",fix:"{ shell: false } to prevent shell interpretation",documentationLink:"https://nodejs.org/api/child_process.html#spawning-bat-and-cmd-files-on-windows"}),strategyValidate:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Validate Strategy",description:"Comprehensive input validation",severity:"LOW",fix:"Add allowlist validation before command execution",documentationLink:"https://owasp.org/www-community/attacks/Command_Injection"}),strategySanitize:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Sanitize Strategy",description:"Sanitize and escape command arguments",severity:"LOW",fix:"Escape special characters in command arguments",documentationLink:"https://owasp.org/www-community/attacks/Command_Injection"}),strategyRestrict:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Restrict Strategy",description:"Restrict to predefined safe commands",severity:"LOW",fix:"Define allowlist of permitted commands",documentationLink:"https://owasp.org/www-community/attacks/Command_Injection"})},schema:[{type:"object",properties:{allowLiteralStrings:{type:"boolean",default:false,description:"Allow exec() with literal strings"},allowLiteralSpawn:{type:"boolean",default:false,description:"Allow spawn() with literal arguments"},additionalMethods:{type:"array",items:{type:"string"},default:[],description:"Additional child_process methods to check"},strategy:{type:"string",enum:["validate","sanitize","restrict","auto"],default:"auto",description:"Strategy for fixing command injection (auto = smart detection)"}},additionalProperties:false}]},defaultOptions:[{allowLiteralStrings:false,allowLiteralSpawn:false,additionalMethods:[],strategy:"auto"}],create(context){const options=context.options[0]||{};const{allowLiteralStrings=false,allowLiteralSpawn=false,additionalMethods=[]}=options;const dangerousMethodsSet=new Set(["exec","execSync","execFile","execFileSync","spawn","spawnSync","fork","forkSync",...additionalMethods]);const moduleAliases=new Set(["child_process"]);const importedMethods=new Set;const containsDynamicStrings=node=>{if(node.type==="TemplateLiteral"){return node.expressions.length>0}if(node.type==="BinaryExpression"&&node.operator==="+"){return true}if(node.type==="Identifier"){return true}return false};const hasOnlyLiteralArgs=args=>{if(args.length===0)return false;const command=args[0];if(command.type!=="Literal"||typeof command.value!=="string"){return false}if(args.length>=2){const argsArray=args[1];if(argsArray.type==="ArrayExpression"){const allLiteralElements=argsArray.elements.every(el=>el?.type==="Literal"&&typeof el.value==="string");if(!allLiteralElements){return false}}else if(argsArray.type!=="Literal"){return false}}return true};const hasShellFalseOption=node=>{const optionsArg=node.arguments[2];if(!optionsArg||optionsArg.type!==eslint_devkit_1.AST_NODE_TYPES.ObjectExpression){return true}for(const prop of optionsArg.properties){if(prop.type===eslint_devkit_1.AST_NODE_TYPES.Property&&prop.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&prop.key.name==="shell"){if(prop.value.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&prop.value.value===false){return true}return false}}return true};const hasPrecedingAllowlistValidation=node=>{const makeArgChecker=validatedVarNames=>{const check=argNode=>{if(argNode.type==="Identifier"&&validatedVarNames.has(argNode.name))return true;if(argNode.type==="TemplateLiteral"){return argNode.expressions.some(e=>e.type==="Identifier"&&validatedVarNames.has(e.name))}if(argNode.type===eslint_devkit_1.AST_NODE_TYPES.ArrayExpression){return argNode.elements.some(el=>el!==null&&check(el))}return false};return check};const checkGuardClause=ifNode=>{const test=ifNode.test;if(test.type==="CallExpression"&&test.callee.type==="MemberExpression"&&test.callee.property.type==="Identifier"&&test.callee.property.name==="includes"){const validatedVarNames=new Set;for(const testArg of test.arguments){if(testArg.type==="Identifier")validatedVarNames.add(testArg.name)}const check=makeArgChecker(validatedVarNames);for(const arg of node.arguments){if(check(arg))return true}}if(test.type===eslint_devkit_1.AST_NODE_TYPES.UnaryExpression&&test.operator==="!"&&test.argument.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&test.argument.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&test.argument.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&test.argument.callee.property.name==="includes"){const consequent=ifNode.consequent;const isGuardBody=consequent.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement||consequent.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement||consequent.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement&&consequent.body.length>0&&(consequent.body[0].type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement||consequent.body[0].type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement);if(isGuardBody){const validatedVarNames=new Set;for(const testArg of test.argument.arguments){if(testArg.type==="Identifier")validatedVarNames.add(testArg.name)}const check=makeArgChecker(validatedVarNames.size>0?validatedVarNames:new Set(["*"]));if(validatedVarNames.size>0){for(const arg of node.arguments){if(check(arg))return true}}else{for(const arg of node.arguments){if(arg.type==="Identifier"||arg.type===eslint_devkit_1.AST_NODE_TYPES.ArrayExpression&&arg.elements.some(el=>el?.type==="Identifier")){return true}}}}}return false};let current=node.parent;while(current){if(current.type==="IfStatement"){if(checkGuardClause(current))return true}current=current.parent}let stmt=node.parent;while(stmt&&stmt.parent&&stmt.parent.type!==eslint_devkit_1.AST_NODE_TYPES.BlockStatement){stmt=stmt.parent}if(stmt&&stmt.parent&&stmt.parent.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement){const block=stmt.parent;const callIndex=block.body.indexOf(stmt);if(callIndex>0){for(let i=0;i<callIndex;i++){const sibling=block.body[i];if(sibling.type==="IfStatement"){if(checkGuardClause(sibling))return true}}}}return false};const extractCommandInfo=(node,method)=>{const sourceCode=context.sourceCode;const args=node.arguments.map(arg=>sourceCode.getText(arg)).join(", ");const pattern=COMMAND_PATTERNS.find(p=>p.method===method)||null;const isDynamic=node.arguments.some(arg=>containsDynamicStrings(arg));return{args,pattern,isDynamic}};const determineRiskLevel=(pattern,isDynamic)=>{if(pattern?.dangerous&&isDynamic){return"critical"}if(pattern?.dangerous||isDynamic){return"high"}return"medium"};const getChildProcessCall=node=>{if(node.callee.type==="MemberExpression"&&node.callee.property.type==="Identifier"){const methodName=node.callee.property.name;if(!dangerousMethodsSet.has(methodName)){return null}if(node.callee.object.type==="Identifier"&&moduleAliases.has(node.callee.object.name)){return{method:methodName,calleeNode:node.callee}}}if(node.callee.type==="Identifier"&&dangerousMethodsSet.has(node.callee.name)){if(importedMethods.has(node.callee.name)){return{method:node.callee.name,calleeNode:node.callee}}}return null};const checkChildProcessCall=node=>{const detected=getChildProcessCall(node);if(!detected){return}const{method}=detected;const{args,pattern,isDynamic}=extractCommandInfo(node,method);if((method==="exec"||method==="execSync")&&!isDynamic&&hasOnlyLiteralArgs(node.arguments)){return}if(allowLiteralStrings&&method==="exec"&&!isDynamic){return}const saferMethods=new Set(["spawn","spawnSync","execFile","execFileSync"]);if(allowLiteralSpawn&&saferMethods.has(method)&&hasOnlyLiteralArgs(node.arguments)){return}if(saferMethods.has(method)&&hasOnlyLiteralArgs(node.arguments)){const isExecFile=method==="execFile"||method==="execFileSync";if(isExecFile||hasShellFalseOption(node)){return}}const allSafeMethods=["execFile","execFileSync","spawn","spawnSync"];if(allSafeMethods.includes(method)&&hasPrecedingAllowlistValidation(node)){return}const riskLevel=determineRiskLevel(pattern,isDynamic);const steps=pattern?(0,exports.generateRefactoringSteps)(pattern):"Review and secure command execution";const alternatives=pattern?.safeAlternatives.join(", ")||"execFile, spawn with validation";context.report({node,messageId:"childProcessCommandInjection",data:{method,args,riskLevel,vulnerability:pattern?.vulnerability||"command injection",alternatives,steps,effort:pattern?.effort||"15-30 minutes"},suggest:[{messageId:"useExecFile",fix:()=>null},{messageId:"useSpawn",fix:()=>null},{messageId:"useSaferLibrary",fix:()=>null},{messageId:"validateInput",fix:()=>null},{messageId:"useShellFalse",fix:()=>null}]})};const trackChildProcessImport=node=>{if(node.source.value!=="child_process"){return}for(const specifier of node.specifiers){if(specifier.type==="ImportDefaultSpecifier"||specifier.type==="ImportNamespaceSpecifier"){moduleAliases.add(specifier.local.name)}if(specifier.type==="ImportSpecifier"){importedMethods.add(specifier.local.name)}}};const trackChildProcessRequire=node=>{if(!node.init){return}if(node.id.type==="Identifier"&&node.init.type==="CallExpression"&&node.init.callee.type==="Identifier"&&node.init.callee.name==="require"&&node.init.arguments[0]&&node.init.arguments[0].type==="Literal"&&node.init.arguments[0].value==="child_process"){moduleAliases.add(node.id.name);return}if(node.id.type==="ObjectPattern"&&node.init?.type==="CallExpression"&&node.init.callee.type==="Identifier"&&node.init.callee.name==="require"&&node.init.arguments[0]&&node.init.arguments[0].type==="Literal"&&node.init.arguments[0].value==="child_process"){for(const prop of node.id.properties){if(prop.type==="Property"&&prop.key.type==="Identifier"){importedMethods.add(prop.value.type==="Identifier"?prop.value.name:prop.key.name)}}}};return{CallExpression:checkChildProcessCall,ImportDeclaration:trackChildProcessImport,VariableDeclarator:trackChildProcessRequire}}});