eslint-plugin-node-security 4.7.3 → 4.8.1

package/src/rules/no-cryptojs/index.js

@@ -1,99 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noCryptojs = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noCryptojs = (0, eslint_devkit_1.createRule)({
-    name: 'no-cryptojs',
-    meta: {
-        type: 'suggestion',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs.md',
-            description: 'Disallow deprecated crypto-js library (use native crypto instead)',
-            cwe: 'CWE-1104',
-            cvss: 5.3,
-        },
-        hasSuggestions: true,
-        messages: {
-            deprecatedCryptojs: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.WARNING,
-                issueName: 'Deprecated crypto-js library',
-                cwe: 'CWE-1104',
-                description: 'crypto-js is no longer maintained (last update: 2022). Future vulnerabilities will not be patched.',
-                severity: 'MEDIUM',
-                fix: 'Migrate to native Node.js crypto module or Web Crypto API',
-                documentationLink: 'https://nodejs.org/api/crypto.html',
-            }),
-            useNativeCrypto: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Node.js crypto',
-                description: 'Node.js crypto module is maintained by the Node.js core team',
-                severity: 'LOW',
-                fix: 'import crypto from "node:crypto"',
-                documentationLink: 'https://nodejs.org/api/crypto.html',
-            }),
-            useWebCrypto: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Web Crypto API',
-                description: 'Web Crypto API works in browsers and Node.js',
-                severity: 'LOW',
-                fix: 'globalThis.crypto.subtle',
-                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    severity: {
-                        type: 'string',
-                        enum: ['error', 'warn'],
-                        default: 'warn',
-                        description: 'Severity level for the rule',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            severity: 'warn',
-        },
-    ],
-    create(context) {
-        function reportDeprecatedLibrary(node) {
-            context.report({
-                node,
-                messageId: 'deprecatedCryptojs',
-                suggest: [
-                    {
-                        messageId: 'useNativeCrypto',
-                        fix: () => null,
-                    },
-                    {
-                        messageId: 'useWebCrypto',
-                        fix: () => null,
-                    },
-                ],
-            });
-        }
-        return {
-            ImportDeclaration(node) {
-                if (typeof node.source.value === 'string' &&
-                    (node.source.value === 'crypto-js' || node.source.value.startsWith('crypto-js/'))) {
-                    reportDeprecatedLibrary(node);
-                }
-            },
-            CallExpression(node) {
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.name === 'require' &&
-                    node.arguments.length === 1 &&
-                    node.arguments[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                    typeof node.arguments[0].value === 'string' &&
-                    (node.arguments[0].value === 'crypto-js' || node.arguments[0].value.startsWith('crypto-js/'))) {
-                    reportDeprecatedLibrary(node);
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noCryptojs=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noCryptojs=(0,eslint_devkit_1.createRule)({name:"no-cryptojs",meta:{type:"suggestion",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs.md",description:"Disallow deprecated crypto-js library (use native crypto instead)",cwe:"CWE-1104",cvss:5.3},hasSuggestions:true,messages:{deprecatedCryptojs:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.WARNING,issueName:"Deprecated crypto-js library",cwe:"CWE-1104",description:"crypto-js is no longer maintained (last update: 2022). Future vulnerabilities will not be patched.",severity:"MEDIUM",fix:"Migrate to native Node.js crypto module or Web Crypto API",documentationLink:"https://nodejs.org/api/crypto.html"}),useNativeCrypto:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Node.js crypto",description:"Node.js crypto module is maintained by the Node.js core team",severity:"LOW",fix:'import crypto from "node:crypto"',documentationLink:"https://nodejs.org/api/crypto.html"}),useWebCrypto:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Web Crypto API",description:"Web Crypto API works in browsers and Node.js",severity:"LOW",fix:"globalThis.crypto.subtle",documentationLink:"https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API"})},schema:[{type:"object",properties:{severity:{type:"string",enum:["error","warn"],default:"warn",description:"Severity level for the rule"}},additionalProperties:false}]},defaultOptions:[{severity:"warn"}],create(context){function reportDeprecatedLibrary(node){context.report({node,messageId:"deprecatedCryptojs",suggest:[{messageId:"useNativeCrypto",fix:()=>null},{messageId:"useWebCrypto",fix:()=>null}]})}return{ImportDeclaration(node){if(typeof node.source.value==="string"&&(node.source.value==="crypto-js"||node.source.value.startsWith("crypto-js/"))){reportDeprecatedLibrary(node)}},CallExpression(node){if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="require"&&node.arguments.length===1&&node.arguments[0].type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof node.arguments[0].value==="string"&&(node.arguments[0].value==="crypto-js"||node.arguments[0].value.startsWith("crypto-js/"))){reportDeprecatedLibrary(node)}}}}});

package/src/rules/no-cryptojs-weak-random/index.js

@@ -1,103 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noCryptojsWeakRandom = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noCryptojsWeakRandom = (0, eslint_devkit_1.createRule)({
-    name: 'no-cryptojs-weak-random',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs-weak-random.md',
-            description: 'Disallow crypto-js WordArray.random() (CVE-2020-36732)',
-            cwe: 'CWE-338',
-            cvss: 5.3,
-        },
-        hasSuggestions: true,
-        messages: {
-            weakRandom: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Weak random in crypto-js',
-                cwe: 'CWE-338',
-                description: 'CryptoJS.lib.WordArray.random() was insecure in versions < 3.2.1 (CVE-2020-36732). Used Math.random() instead of CSPRNG.',
-                severity: 'CRITICAL',
-                fix: 'Use crypto.randomBytes() from Node.js or crypto.getRandomValues() in browsers',
-                documentationLink: 'https://nvd.nist.gov/vuln/detail/CVE-2020-36732',
-            }),
-            useNativeRandom: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use native randomBytes',
-                description: 'Use cryptographically secure random from native crypto',
-                severity: 'LOW',
-                fix: 'crypto.randomBytes(32)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
-                const callee = node.callee;
-                if (callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    callee.property.name === 'random') {
-                    if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && callee.object.name === 'WordArray') {
-                        reportWeakRandom(node);
-                        return;
-                    }
-                    if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
-                        const innerObj = callee.object;
-                        if (innerObj.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            innerObj.property.name === 'WordArray') {
-                            reportWeakRandom(node);
-                            return;
-                        }
-                    }
-                }
-            }
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.callee.object.name === 'CryptoJS' &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.callee.property.name === 'random') {
-                reportWeakRandom(node);
-            }
-        }
-        function reportWeakRandom(node) {
-            context.report({
-                node,
-                messageId: 'weakRandom',
-                suggest: [
-                    {
-                        messageId: 'useNativeRandom',
-                        fix: () => null,
-                    },
-                ],
-            });
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noCryptojsWeakRandom=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noCryptojsWeakRandom=(0,eslint_devkit_1.createRule)({name:"no-cryptojs-weak-random",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-cryptojs-weak-random.md",description:"Disallow crypto-js WordArray.random() (CVE-2020-36732)",cwe:"CWE-338",cvss:5.3},hasSuggestions:true,messages:{weakRandom:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Weak random in crypto-js",cwe:"CWE-338",description:"CryptoJS.lib.WordArray.random() was insecure in versions < 3.2.1 (CVE-2020-36732). Used Math.random() instead of CSPRNG.",severity:"CRITICAL",fix:"Use crypto.randomBytes() from Node.js or crypto.getRandomValues() in browsers",documentationLink:"https://nvd.nist.gov/vuln/detail/CVE-2020-36732"}),useNativeRandom:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use native randomBytes",description:"Use cryptographically secure random from native crypto",severity:"LOW",fix:"crypto.randomBytes(32)",documentationLink:"https://nodejs.org/api/crypto.html#cryptorandombytessize-callback"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkCallExpression(node){if(isTestFile)return;if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression){const callee=node.callee;if(callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&callee.property.name==="random"){if(callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&callee.object.name==="WordArray"){reportWeakRandom(node);return}if(callee.object.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression){const innerObj=callee.object;if(innerObj.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&innerObj.property.name==="WordArray"){reportWeakRandom(node);return}}}}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.object.name==="CryptoJS"&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.property.name==="random"){reportWeakRandom(node)}}function reportWeakRandom(node){context.report({node,messageId:"weakRandom",suggest:[{messageId:"useNativeRandom",fix:()=>null}]})}return{CallExpression:checkCallExpression}}});

package/src/rules/no-data-in-temp-storage/index.js

@@ -1,85 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDataInTempStorage = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const DEFAULT_TEMP_PATHS = ['/tmp', '/var/tmp', 'temp/', '/temp'];
-exports.noDataInTempStorage = (0, eslint_devkit_1.createRule)({
-    name: 'no-data-in-temp-storage',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-data-in-temp-storage.md',
-            description: 'Prevent sensitive data in temp directories',
-            cwe: 'CWE-312',
-            cvss: 7.5,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Temp Storage Data',
-                cwe: 'CWE-312',
-                description: 'Sensitive data written to temp directory - not secure',
-                severity: 'HIGH',
-                fix: 'Use secure storage location or encrypt data before writing',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/312.html',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    tempPaths: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        description: 'Custom list of temporary paths to flag'
-                    },
-                    ignoreFiles: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        description: 'List of files or patterns to ignore'
-                    }
-                },
-                additionalProperties: false
-            }
-        ],
-    },
-    defaultOptions: [{}],
-    create(context) {
-        const options = context.options[0] || {};
-        const tempPaths = options.tempPaths || DEFAULT_TEMP_PATHS;
-        const ignoreFiles = options.ignoreFiles || [];
-        const filename = context.filename;
-        if (ignoreFiles.some(pattern => filename.includes(pattern))) {
-            return {};
-        }
-        function report(node) {
-            context.report({ node, messageId: 'violationDetected' });
-        }
-        return {
-            CallExpression(node) {
-                if (node.callee.type === 'MemberExpression' &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'fs' &&
-                    node.callee.property.type === 'Identifier' &&
-                    ['writeFileSync', 'writeFile'].includes(node.callee.property.name)) {
-                    const pathArg = node.arguments[0];
-                    if (pathArg && pathArg.type === 'Literal' && typeof pathArg.value === 'string') {
-                        if (tempPaths.some(tp => pathArg.value.includes(tp))) {
-                            report(pathArg);
-                        }
-                    }
-                }
-            },
-            Literal(node) {
-                if (typeof node.value === 'string') {
-                    if (tempPaths.some(tp => node.value.includes(tp))) {
-                        const parent = node.parent;
-                        if (parent?.type === 'VariableDeclarator' || parent?.type === 'AssignmentExpression') {
-                            report(node);
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDataInTempStorage=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const DEFAULT_TEMP_PATHS=["/tmp","/var/tmp","temp/","/temp"];exports.noDataInTempStorage=(0,eslint_devkit_1.createRule)({name:"no-data-in-temp-storage",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-data-in-temp-storage.md",description:"Prevent sensitive data in temp directories",cwe:"CWE-312",cvss:7.5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Temp Storage Data",cwe:"CWE-312",description:"Sensitive data written to temp directory - not secure",severity:"HIGH",fix:"Use secure storage location or encrypt data before writing",documentationLink:"https://cwe.mitre.org/data/definitions/312.html"})},schema:[{type:"object",properties:{tempPaths:{type:"array",items:{type:"string"},description:"Custom list of temporary paths to flag"},ignoreFiles:{type:"array",items:{type:"string"},description:"List of files or patterns to ignore"}},additionalProperties:false}]},defaultOptions:[{}],create(context){const options=context.options[0]||{};const tempPaths=options.tempPaths||DEFAULT_TEMP_PATHS;const ignoreFiles=options.ignoreFiles||[];const filename=context.filename;if(ignoreFiles.some(pattern=>filename.includes(pattern))){return{}}function report(node){context.report({node,messageId:"violationDetected"})}return{CallExpression(node){if(node.callee.type==="MemberExpression"&&node.callee.object.type==="Identifier"&&node.callee.object.name==="fs"&&node.callee.property.type==="Identifier"&&["writeFileSync","writeFile"].includes(node.callee.property.name)){const pathArg=node.arguments[0];if(pathArg&&pathArg.type==="Literal"&&typeof pathArg.value==="string"){if(tempPaths.some(tp=>pathArg.value.includes(tp))){report(pathArg)}}}},Literal(node){if(typeof node.value==="string"){if(tempPaths.some(tp=>node.value.includes(tp))){const parent=node.parent;if(parent?.type==="VariableDeclarator"||parent?.type==="AssignmentExpression"){report(node)}}}}}}});

package/src/rules/no-deprecated-buffer/index.js

@@ -1,84 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDeprecatedBuffer = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noDeprecatedBuffer = (0, eslint_devkit_1.createRule)({
-    name: 'no-deprecated-buffer',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-deprecated-buffer.md',
-            description: 'Disallow the deprecated `new Buffer()` constructor and `Buffer()` factory call.',
-            cwe: 'CWE-676',
-            cvss: 7.5,
-        },
-        fixable: 'code',
-        messages: {
-            deprecatedBufferConstructor: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Deprecated Buffer Constructor',
-                cwe: 'CWE-676',
-                cvss: 7.5,
-                description: '`new Buffer()` is deprecated since Node 10 and unsafe — when called with a number it returns uninitialized memory (CVE-2018-7166).',
-                severity: 'HIGH',
-                fix: 'Use `Buffer.alloc(size)` (zero-filled), `Buffer.allocUnsafe(size)` (only when you immediately overwrite the buffer), or `Buffer.from(value)` (for strings/arrays/buffers).',
-                documentationLink: 'https://nodejs.org/api/buffer.html#bufnew-buffersize',
-            }),
-            deprecatedBufferCall: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Deprecated Buffer() Factory Call',
-                cwe: 'CWE-676',
-                cvss: 7.5,
-                description: '`Buffer()` (without `new`) is deprecated since Node 10 and unsafe — when called with a number it returns uninitialized memory.',
-                severity: 'HIGH',
-                fix: 'Use `Buffer.alloc(size)`, `Buffer.allocUnsafe(size)`, or `Buffer.from(value)`.',
-                documentationLink: 'https://nodejs.org/api/buffer.html#bufnew-buffersize',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        function isBufferIdentifier(node) {
-            return (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.name === 'Buffer');
-        }
-        function getBufferReplacement(args) {
-            if (args.length === 1 &&
-                args[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                typeof args[0].value === 'number') {
-                return 'Buffer.alloc';
-            }
-            return 'Buffer.from';
-        }
-        return {
-            NewExpression(node) {
-                if (!isBufferIdentifier(node.callee))
-                    return;
-                const replacement = getBufferReplacement(node.arguments);
-                context.report({
-                    node,
-                    messageId: 'deprecatedBufferConstructor',
-                    fix(fixer) {
-                        const sourceCode = context.sourceCode;
-                        const newToken = sourceCode.getFirstToken(node);
-                        const calleeEnd = node.callee.range[1];
-                        return fixer.replaceTextRange([newToken.range[0], calleeEnd], replacement);
-                    },
-                });
-            },
-            CallExpression(node) {
-                if (!isBufferIdentifier(node.callee))
-                    return;
-                const replacement = getBufferReplacement(node.arguments);
-                context.report({
-                    node,
-                    messageId: 'deprecatedBufferCall',
-                    fix(fixer) {
-                        return fixer.replaceText(node.callee, replacement);
-                    },
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDeprecatedBuffer=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noDeprecatedBuffer=(0,eslint_devkit_1.createRule)({name:"no-deprecated-buffer",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-deprecated-buffer.md",description:"Disallow the deprecated `new Buffer()` constructor and `Buffer()` factory call.",cwe:"CWE-676",cvss:7.5},fixable:"code",messages:{deprecatedBufferConstructor:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Deprecated Buffer Constructor",cwe:"CWE-676",cvss:7.5,description:"`new Buffer()` is deprecated since Node 10 and unsafe \u2014 when called with a number it returns uninitialized memory (CVE-2018-7166).",severity:"HIGH",fix:"Use `Buffer.alloc(size)` (zero-filled), `Buffer.allocUnsafe(size)` (only when you immediately overwrite the buffer), or `Buffer.from(value)` (for strings/arrays/buffers).",documentationLink:"https://nodejs.org/api/buffer.html#bufnew-buffersize"}),deprecatedBufferCall:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Deprecated Buffer() Factory Call",cwe:"CWE-676",cvss:7.5,description:"`Buffer()` (without `new`) is deprecated since Node 10 and unsafe \u2014 when called with a number it returns uninitialized memory.",severity:"HIGH",fix:"Use `Buffer.alloc(size)`, `Buffer.allocUnsafe(size)`, or `Buffer.from(value)`.",documentationLink:"https://nodejs.org/api/buffer.html#bufnew-buffersize"})},schema:[]},defaultOptions:[],create(context){function isBufferIdentifier(node){return node.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.name==="Buffer"}function getBufferReplacement(args){if(args.length===1&&args[0].type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof args[0].value==="number"){return"Buffer.alloc"}return"Buffer.from"}return{NewExpression(node){if(!isBufferIdentifier(node.callee))return;const replacement=getBufferReplacement(node.arguments);context.report({node,messageId:"deprecatedBufferConstructor",fix(fixer){const sourceCode=context.sourceCode;const newToken=sourceCode.getFirstToken(node);const calleeEnd=node.callee.range[1];return fixer.replaceTextRange([newToken.range[0],calleeEnd],replacement)}})},CallExpression(node){if(!isBufferIdentifier(node.callee))return;const replacement=getBufferReplacement(node.arguments);context.report({node,messageId:"deprecatedBufferCall",fix(fixer){return fixer.replaceText(node.callee,replacement)}})}}}});

package/src/rules/no-deprecated-cipher-method/index.js

@@ -1,112 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDeprecatedCipherMethod = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const DEPRECATED_METHODS = new Set(['createCipher', 'createDecipher']);
-exports.noDeprecatedCipherMethod = (0, eslint_devkit_1.createRule)({
-    name: 'no-deprecated-cipher-method',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-deprecated-cipher-method.md',
-            description: 'Disallow deprecated crypto.createCipher/createDecipher methods (use createCipheriv/createDecipheriv instead)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            deprecatedCipherMethod: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Deprecated cipher method',
-                cwe: 'CWE-327',
-                description: 'crypto.{{method}}() is deprecated. It derives key from password without salt and uses no IV, making encryption deterministic and vulnerable.',
-                severity: 'HIGH',
-                fix: 'Use crypto.{{replacement}}() with explicit key and random IV',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-            useCipheriv: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use createCipheriv',
-                description: 'Use createCipheriv with explicit key derivation and random IV',
-                severity: 'LOW',
-                fix: 'const key = crypto.scryptSync(password, salt, 32);\nconst iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(algorithm, key, iv);',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow deprecated methods in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                DEPRECATED_METHODS.has(node.callee.property.name)) {
-                const callee = node.callee;
-                const propertyNode = callee.property;
-                const methodName = propertyNode.name;
-                const replacementName = methodName === 'createCipher' ? 'createCipheriv' : 'createDecipheriv';
-                context.report({
-                    node: propertyNode,
-                    messageId: 'deprecatedCipherMethod',
-                    data: {
-                        method: methodName,
-                        replacement: replacementName,
-                    },
-                    suggest: [
-                        {
-                            messageId: 'useCipheriv',
-                            fix: (fixer) => {
-                                return fixer.replaceText(propertyNode, replacementName);
-                            },
-                        },
-                    ],
-                });
-            }
-            if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                DEPRECATED_METHODS.has(node.callee.name)) {
-                const methodName = node.callee.name;
-                const replacementName = methodName === 'createCipher' ? 'createCipheriv' : 'createDecipheriv';
-                context.report({
-                    node: node.callee,
-                    messageId: 'deprecatedCipherMethod',
-                    data: {
-                        method: methodName,
-                        replacement: replacementName,
-                    },
-                    suggest: [
-                        {
-                            messageId: 'useCipheriv',
-                            fix: (fixer) => {
-                                return fixer.replaceText(node.callee, replacementName);
-                            },
-                        },
-                    ],
-                });
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDeprecatedCipherMethod=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const DEPRECATED_METHODS=new Set(["createCipher","createDecipher"]);exports.noDeprecatedCipherMethod=(0,eslint_devkit_1.createRule)({name:"no-deprecated-cipher-method",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-deprecated-cipher-method.md",description:"Disallow deprecated crypto.createCipher/createDecipher methods (use createCipheriv/createDecipheriv instead)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{deprecatedCipherMethod:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Deprecated cipher method",cwe:"CWE-327",description:"crypto.{{method}}() is deprecated. It derives key from password without salt and uses no IV, making encryption deterministic and vulnerable.",severity:"HIGH",fix:"Use crypto.{{replacement}}() with explicit key and random IV",documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"}),useCipheriv:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use createCipheriv",description:"Use createCipheriv with explicit key derivation and random IV",severity:"LOW",fix:"const key = crypto.scryptSync(password, salt, 32);\nconst iv = crypto.randomBytes(16);\nconst cipher = crypto.createCipheriv(algorithm, key, iv);",documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow deprecated methods in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkCallExpression(node){if(isTestFile)return;if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&DEPRECATED_METHODS.has(node.callee.property.name)){const callee=node.callee;const propertyNode=callee.property;const methodName=propertyNode.name;const replacementName=methodName==="createCipher"?"createCipheriv":"createDecipheriv";context.report({node:propertyNode,messageId:"deprecatedCipherMethod",data:{method:methodName,replacement:replacementName},suggest:[{messageId:"useCipheriv",fix:fixer=>{return fixer.replaceText(propertyNode,replacementName)}}]})}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&DEPRECATED_METHODS.has(node.callee.name)){const methodName=node.callee.name;const replacementName=methodName==="createCipher"?"createCipheriv":"createDecipheriv";context.report({node:node.callee,messageId:"deprecatedCipherMethod",data:{method:methodName,replacement:replacementName},suggest:[{messageId:"useCipheriv",fix:fixer=>{return fixer.replaceText(node.callee,replacementName)}}]})}}return{CallExpression:checkCallExpression}}});

package/src/rules/no-dynamic-algorithm-selection/index.js

@@ -1,72 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDynamicAlgorithmSelection = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const CRYPTO_ALGORITHM_FUNCTIONS = new Set([
-    'createHash',
-    'createHmac',
-    'createSign',
-    'createVerify',
-    'createCipher',
-    'createCipheriv',
-    'createDecipher',
-    'createDecipheriv',
-]);
-exports.noDynamicAlgorithmSelection = (0, eslint_devkit_1.createRule)({
-    name: 'no-dynamic-algorithm-selection',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-algorithm-selection.md',
-            description: 'Disallow dynamic algorithm names in Node.js crypto functions (CWE-327)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        messages: {
-            dynamicAlgorithm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Dynamic Cryptographic Algorithm (CWE-327)',
-                cwe: 'CWE-327',
-                description: '`crypto.{{method}}()` receives a dynamic algorithm name. An attacker who controls this value can downgrade to a weak algorithm (MD5, SHA1, RC4) or cause a crash.',
-                severity: 'HIGH',
-                fix: 'Hard-code the algorithm name as a literal string (e.g. "sha256", "aes-256-gcm"). Use an allowlist if the algorithm must vary at runtime.',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        return {
-            CallExpression(node) {
-                const { callee, arguments: args } = node;
-                if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression)
-                    return;
-                if (callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
-                    return;
-                if (callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
-                    return;
-                const objectName = callee.object.name;
-                const methodName = callee.property.name;
-                if (objectName !== 'crypto')
-                    return;
-                if (!CRYPTO_ALGORITHM_FUNCTIONS.has(methodName))
-                    return;
-                const firstArg = args[0];
-                if (!firstArg)
-                    return;
-                if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                    typeof firstArg.value === 'string')
-                    return;
-                if (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral &&
-                    firstArg.expressions.length === 0)
-                    return;
-                context.report({
-                    node: firstArg,
-                    messageId: 'dynamicAlgorithm',
-                    data: { method: methodName },
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDynamicAlgorithmSelection=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const CRYPTO_ALGORITHM_FUNCTIONS=new Set(["createHash","createHmac","createSign","createVerify","createCipher","createCipheriv","createDecipher","createDecipheriv"]);exports.noDynamicAlgorithmSelection=(0,eslint_devkit_1.createRule)({name:"no-dynamic-algorithm-selection",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-algorithm-selection.md",description:"Disallow dynamic algorithm names in Node.js crypto functions (CWE-327)",cwe:"CWE-327",cvss:7.5},messages:{dynamicAlgorithm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Dynamic Cryptographic Algorithm (CWE-327)",cwe:"CWE-327",description:"`crypto.{{method}}()` receives a dynamic algorithm name. An attacker who controls this value can downgrade to a weak algorithm (MD5, SHA1, RC4) or cause a crash.",severity:"HIGH",fix:'Hard-code the algorithm name as a literal string (e.g. "sha256", "aes-256-gcm"). Use an allowlist if the algorithm must vary at runtime.',documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"})},schema:[]},defaultOptions:[],create(context){return{CallExpression(node){const{callee,arguments:args}=node;if(callee.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression)return;if(callee.object.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return;if(callee.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return;const objectName=callee.object.name;const methodName=callee.property.name;if(objectName!=="crypto")return;if(!CRYPTO_ALGORITHM_FUNCTIONS.has(methodName))return;const firstArg=args[0];if(!firstArg)return;if(firstArg.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof firstArg.value==="string")return;if(firstArg.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral&&firstArg.expressions.length===0)return;context.report({node:firstArg,messageId:"dynamicAlgorithm",data:{method:methodName}})}}}});