eslint-plugin-node-security 4.7.3 → 4.8.1

package/src/rules/no-insecure-rsa-padding/index.js

@@ -1,104 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noInsecureRsaPadding = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const PKCS1_PADDING_NAMES = new Set([
-    'RSA_PKCS1_PADDING',
-    'constants.RSA_PKCS1_PADDING',
-    'crypto.constants.RSA_PKCS1_PADDING',
-]);
-exports.noInsecureRsaPadding = (0, eslint_devkit_1.createRule)({
-    name: 'no-insecure-rsa-padding',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-rsa-padding.md',
-            description: 'Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            insecureRsaPadding: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Insecure RSA padding',
-                cwe: 'CWE-327',
-                description: 'RSA PKCS#1 v1.5 padding is vulnerable to the Marvin Attack (CVE-2023-46809). Timing side-channels allow attackers to decrypt ciphertexts or forge signatures.',
-                severity: 'HIGH',
-                fix: 'Use RSA_PKCS1_OAEP_PADDING instead',
-                documentationLink: 'https://people.redhat.com/~hkario/marvin/',
-            }),
-            useOaep: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use OAEP padding',
-                description: 'Use RSA-OAEP which is not vulnerable to padding oracle attacks',
-                severity: 'LOW',
-                fix: 'padding: crypto.constants.RSA_PKCS1_OAEP_PADDING',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptopublicdecryptkey-buffer',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        const sourceCode = context.sourceCode;
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            const rsaMethods = new Set(['privateDecrypt', 'publicDecrypt', 'privateEncrypt', 'publicEncrypt']);
-            const isRsaCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                rsaMethods.has(node.callee.property.name)) ||
-                (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    rsaMethods.has(node.callee.name));
-            if (isRsaCall && node.arguments.length >= 1) {
-                const keyArg = node.arguments[0];
-                if (keyArg.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
-                    for (const prop of keyArg.properties) {
-                        if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
-                            prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            prop.key.name === 'padding') {
-                            const paddingText = sourceCode.getText(prop.value);
-                            if (PKCS1_PADDING_NAMES.has(paddingText) || paddingText.includes('RSA_PKCS1_PADDING')) {
-                                context.report({
-                                    node: prop,
-                                    messageId: 'insecureRsaPadding',
-                                    suggest: [
-                                        {
-                                            messageId: 'useOaep',
-                                            fix: (fixer) => {
-                                                return fixer.replaceText(prop.value, 'crypto.constants.RSA_PKCS1_OAEP_PADDING');
-                                            },
-                                        },
-                                    ],
-                                });
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noInsecureRsaPadding=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const PKCS1_PADDING_NAMES=new Set(["RSA_PKCS1_PADDING","constants.RSA_PKCS1_PADDING","crypto.constants.RSA_PKCS1_PADDING"]);exports.noInsecureRsaPadding=(0,eslint_devkit_1.createRule)({name:"no-insecure-rsa-padding",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-rsa-padding.md",description:"Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{insecureRsaPadding:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Insecure RSA padding",cwe:"CWE-327",description:"RSA PKCS#1 v1.5 padding is vulnerable to the Marvin Attack (CVE-2023-46809). Timing side-channels allow attackers to decrypt ciphertexts or forge signatures.",severity:"HIGH",fix:"Use RSA_PKCS1_OAEP_PADDING instead",documentationLink:"https://people.redhat.com/~hkario/marvin/"}),useOaep:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use OAEP padding",description:"Use RSA-OAEP which is not vulnerable to padding oracle attacks",severity:"LOW",fix:"padding: crypto.constants.RSA_PKCS1_OAEP_PADDING",documentationLink:"https://nodejs.org/api/crypto.html#cryptopublicdecryptkey-buffer"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);const sourceCode=context.sourceCode;function checkCallExpression(node){if(isTestFile)return;const rsaMethods=new Set(["privateDecrypt","publicDecrypt","privateEncrypt","publicEncrypt"]);const isRsaCall=node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&rsaMethods.has(node.callee.property.name)||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&rsaMethods.has(node.callee.name);if(isRsaCall&&node.arguments.length>=1){const keyArg=node.arguments[0];if(keyArg.type===eslint_devkit_1.AST_NODE_TYPES.ObjectExpression){for(const prop of keyArg.properties){if(prop.type===eslint_devkit_1.AST_NODE_TYPES.Property&&prop.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&prop.key.name==="padding"){const paddingText=sourceCode.getText(prop.value);if(PKCS1_PADDING_NAMES.has(paddingText)||paddingText.includes("RSA_PKCS1_PADDING")){context.report({node:prop,messageId:"insecureRsaPadding",suggest:[{messageId:"useOaep",fix:fixer=>{return fixer.replaceText(prop.value,"crypto.constants.RSA_PKCS1_OAEP_PADDING")}}]})}}}}}}return{CallExpression:checkCallExpression}}});

package/src/rules/no-math-random-crypto/index.js

@@ -1,192 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noMathRandomCrypto = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const CRYPTO_VARIABLE_PATTERNS = [
-    /token/i,
-    /key/i,
-    /secret/i,
-    /password/i,
-    /salt/i,
-    /iv/i,
-    /nonce/i,
-    /random/i,
-    /seed/i,
-    /hash/i,
-    /cipher/i,
-    /encrypt/i,
-    /auth/i,
-    /session/i,
-    /csrf/i,
-    /otp/i,
-    /pin/i,
-    /code/i,
-    /verify/i,
-];
-const CRYPTO_FUNCTION_PATTERNS = [
-    /generate.*token/i,
-    /generate.*key/i,
-    /generate.*id/i,
-    /create.*secret/i,
-    /create.*token/i,
-    /random.*string/i,
-    /get.*random/i,
-    /make.*salt/i,
-    /gen.*password/i,
-];
-exports.noMathRandomCrypto = (0, eslint_devkit_1.createRule)({
-    name: 'no-math-random-crypto',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-math-random-crypto.md',
-            description: 'Disallow Math.random() for cryptographic purposes',
-            cwe: 'CWE-338',
-            cvss: 5.3,
-            confidence: 'medium',
-        },
-        hasSuggestions: true,
-        messages: {
-            mathRandomCrypto: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Math.random() used for crypto',
-                cwe: 'CWE-338',
-                description: 'Math.random() is not cryptographically secure. It uses a PRNG that can be predicted. Never use it for tokens, keys, passwords, or any security-sensitive values.',
-                severity: 'CRITICAL',
-                fix: 'Use crypto.randomBytes() or crypto.randomUUID() instead',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation',
-            }),
-            useRandomBytes: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use randomBytes',
-                description: 'Use crypto.randomBytes() for cryptographically secure random values',
-                severity: 'LOW',
-                fix: 'crypto.randomBytes(32).toString("hex")',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
-            }),
-            useRandomUUID: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use randomUUID',
-                description: 'Use crypto.randomUUID() for UUID generation',
-                severity: 'LOW',
-                fix: 'crypto.randomUUID()',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandomuuidoptions',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow Math.random() in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function isCryptoContext(node) {
-            let current = node.parent;
-            while (current) {
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator) {
-                    if (current.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                        const varName = current.id.name;
-                        if (CRYPTO_VARIABLE_PATTERNS.some((p) => p.test(varName))) {
-                            return true;
-                        }
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration && current.id) {
-                    const funcName = current.id.name;
-                    if (CRYPTO_FUNCTION_PATTERNS.some((p) => p.test(funcName))) {
-                        return true;
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.AssignmentExpression) {
-                    if (current.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                        current.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                        const propName = current.left.property.name;
-                        if (CRYPTO_VARIABLE_PATTERNS.some((p) => p.test(propName))) {
-                            return true;
-                        }
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.Property) {
-                    if (current.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                        const propName = current.key.name;
-                        if (CRYPTO_VARIABLE_PATTERNS.some((p) => p.test(propName))) {
-                            return true;
-                        }
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
-                    const func = findContainingFunction(current);
-                    if (func) {
-                        if ((func.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
-                            func.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression) &&
-                            func.id?.name) {
-                            const funcName = func.id.name;
-                            if (CRYPTO_FUNCTION_PATTERNS.some((p) => p.test(funcName)) ||
-                                CRYPTO_VARIABLE_PATTERNS.some((p) => p.test(funcName))) {
-                                return true;
-                            }
-                        }
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        }
-        function findContainingFunction(node) {
-            let current = node.parent;
-            while (current) {
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
-                    current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
-                    current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
-                    return current;
-                }
-                current = current.parent;
-            }
-            return null;
-        }
-        return {
-            CallExpression(node) {
-                if (isTestFile)
-                    return;
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.object.name === 'Math' &&
-                    node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.property.name === 'random') {
-                    if (isCryptoContext(node)) {
-                        context.report({
-                            node,
-                            messageId: 'mathRandomCrypto',
-                            suggest: [
-                                {
-                                    messageId: 'useRandomBytes',
-                                    fix: () => null,
-                                },
-                                {
-                                    messageId: 'useRandomUUID',
-                                    fix: () => null,
-                                },
-                            ],
-                        });
-                    }
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noMathRandomCrypto=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const CRYPTO_VARIABLE_PATTERNS=[/token/i,/key/i,/secret/i,/password/i,/salt/i,/iv/i,/nonce/i,/random/i,/seed/i,/hash/i,/cipher/i,/encrypt/i,/auth/i,/session/i,/csrf/i,/otp/i,/pin/i,/code/i,/verify/i];const CRYPTO_FUNCTION_PATTERNS=[/generate.*token/i,/generate.*key/i,/generate.*id/i,/create.*secret/i,/create.*token/i,/random.*string/i,/get.*random/i,/make.*salt/i,/gen.*password/i];exports.noMathRandomCrypto=(0,eslint_devkit_1.createRule)({name:"no-math-random-crypto",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-math-random-crypto.md",description:"Disallow Math.random() for cryptographic purposes",cwe:"CWE-338",cvss:5.3,confidence:"medium"},hasSuggestions:true,messages:{mathRandomCrypto:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Math.random() used for crypto",cwe:"CWE-338",description:"Math.random() is not cryptographically secure. It uses a PRNG that can be predicted. Never use it for tokens, keys, passwords, or any security-sensitive values.",severity:"CRITICAL",fix:"Use crypto.randomBytes() or crypto.randomUUID() instead",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation"}),useRandomBytes:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use randomBytes",description:"Use crypto.randomBytes() for cryptographically secure random values",severity:"LOW",fix:'crypto.randomBytes(32).toString("hex")',documentationLink:"https://nodejs.org/api/crypto.html#cryptorandombytessize-callback"}),useRandomUUID:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use randomUUID",description:"Use crypto.randomUUID() for UUID generation",severity:"LOW",fix:"crypto.randomUUID()",documentationLink:"https://nodejs.org/api/crypto.html#cryptorandomuuidoptions"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow Math.random() in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function isCryptoContext(node){let current=node.parent;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator){if(current.id.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const varName=current.id.name;if(CRYPTO_VARIABLE_PATTERNS.some(p=>p.test(varName))){return true}}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration&&current.id){const funcName=current.id.name;if(CRYPTO_FUNCTION_PATTERNS.some(p=>p.test(funcName))){return true}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.AssignmentExpression){if(current.left.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&current.left.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const propName=current.left.property.name;if(CRYPTO_VARIABLE_PATTERNS.some(p=>p.test(propName))){return true}}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.Property){if(current.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const propName=current.key.name;if(CRYPTO_VARIABLE_PATTERNS.some(p=>p.test(propName))){return true}}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement){const func=findContainingFunction(current);if(func){if((func.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||func.type===eslint_devkit_1.AST_NODE_TYPES.FunctionExpression)&&func.id?.name){const funcName=func.id.name;if(CRYPTO_FUNCTION_PATTERNS.some(p=>p.test(funcName))||CRYPTO_VARIABLE_PATTERNS.some(p=>p.test(funcName))){return true}}}}current=current.parent}return false}function findContainingFunction(node){let current=node.parent;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionExpression||current.type===eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression){return current}current=current.parent}return null}return{CallExpression(node){if(isTestFile)return;if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.object.name==="Math"&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.property.name==="random"){if(isCryptoContext(node)){context.report({node,messageId:"mathRandomCrypto",suggest:[{messageId:"useRandomBytes",fix:()=>null},{messageId:"useRandomUUID",fix:()=>null}]})}}}}}});

package/src/rules/no-self-signed-certs/index.js

@@ -1,110 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSelfSignedCerts = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noSelfSignedCerts = (0, eslint_devkit_1.createRule)({
-    name: 'no-self-signed-certs',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-self-signed-certs.md',
-            description: 'Disallow rejectUnauthorized: false in TLS options',
-            cwe: 'CWE-295',
-            cvss: 9.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            insecureTls: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'TLS certificate validation disabled',
-                cwe: 'CWE-295',
-                description: 'rejectUnauthorized: false disables TLS certificate validation, enabling man-in-the-middle attacks. Any certificate will be accepted, including self-signed and expired ones.',
-                severity: 'CRITICAL',
-                fix: 'Remove rejectUnauthorized: false or set it to true',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html',
-            }),
-            enableValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Enable certificate validation',
-                description: 'Enable proper TLS certificate validation',
-                severity: 'LOW',
-                fix: 'rejectUnauthorized: true (or remove the property)',
-                documentationLink: 'https://nodejs.org/api/tls.html#tlsconnectoptions-callback',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkProperty(node) {
-            if (isTestFile)
-                return;
-            if (node.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.key.name === 'rejectUnauthorized' &&
-                node.value.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                node.value.value === false) {
-                context.report({
-                    node,
-                    messageId: 'insecureTls',
-                    suggest: [
-                        {
-                            messageId: 'enableValidation',
-                            fix: (fixer) => {
-                                return fixer.replaceText(node.value, 'true');
-                            },
-                        },
-                    ],
-                });
-            }
-        }
-        function checkAssignmentExpression(node) {
-            if (isTestFile)
-                return;
-            if (node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.left.object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.left.object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.left.object.object.name === 'process' &&
-                node.left.object.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.left.object.property.name === 'env' &&
-                node.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.left.property.name === 'NODE_TLS_REJECT_UNAUTHORIZED') {
-                if (node.right.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                    (node.right.value === '0' || node.right.value === 0)) {
-                    context.report({
-                        node,
-                        messageId: 'insecureTls',
-                        suggest: [
-                            {
-                                messageId: 'enableValidation',
-                                fix: () => null,
-                            },
-                        ],
-                    });
-                }
-            }
-        }
-        return {
-            Property: checkProperty,
-            AssignmentExpression: checkAssignmentExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSelfSignedCerts=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noSelfSignedCerts=(0,eslint_devkit_1.createRule)({name:"no-self-signed-certs",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-self-signed-certs.md",description:"Disallow rejectUnauthorized: false in TLS options",cwe:"CWE-295",cvss:9.5},hasSuggestions:true,messages:{insecureTls:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"TLS certificate validation disabled",cwe:"CWE-295",description:"rejectUnauthorized: false disables TLS certificate validation, enabling man-in-the-middle attacks. Any certificate will be accepted, including self-signed and expired ones.",severity:"CRITICAL",fix:"Remove rejectUnauthorized: false or set it to true",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html"}),enableValidation:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Enable certificate validation",description:"Enable proper TLS certificate validation",severity:"LOW",fix:"rejectUnauthorized: true (or remove the property)",documentationLink:"https://nodejs.org/api/tls.html#tlsconnectoptions-callback"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkProperty(node){if(isTestFile)return;if(node.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.key.name==="rejectUnauthorized"&&node.value.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&node.value.value===false){context.report({node,messageId:"insecureTls",suggest:[{messageId:"enableValidation",fix:fixer=>{return fixer.replaceText(node.value,"true")}}]})}}function checkAssignmentExpression(node){if(isTestFile)return;if(node.left.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.left.object.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.left.object.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.left.object.object.name==="process"&&node.left.object.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.left.object.property.name==="env"&&node.left.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.left.property.name==="NODE_TLS_REJECT_UNAUTHORIZED"){if(node.right.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&(node.right.value==="0"||node.right.value===0)){context.report({node,messageId:"insecureTls",suggest:[{messageId:"enableValidation",fix:()=>null}]})}}}return{Property:checkProperty,AssignmentExpression:checkAssignmentExpression}}});

package/src/rules/no-sha1-hash/index.js

@@ -1,121 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSha1Hash = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noSha1Hash = (0, eslint_devkit_1.createRule)({
-    name: 'no-sha1-hash',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-sha1-hash.md',
-            description: 'Disallow sha1() from crypto-hash package (use sha256 or sha512)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            sha1Deprecated: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'SHA-1 hash detected',
-                cwe: 'CWE-327',
-                description: 'SHA-1 is cryptographically broken and should not be used. The crypto-hash package itself warns against using sha1().',
-                severity: 'HIGH',
-                fix: 'Use sha256() or sha512() instead',
-                documentationLink: 'https://shattered.io/',
-            }),
-            useSha256: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use sha256',
-                description: 'SHA-256 provides adequate security for most use cases',
-                severity: 'LOW',
-                fix: "import { sha256 } from 'crypto-hash'; await sha256(data)",
-                documentationLink: 'https://www.npmjs.com/package/crypto-hash',
-            }),
-            useSha512: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use sha512',
-                description: 'SHA-512 provides stronger security with longer hash',
-                severity: 'LOW',
-                fix: "import { sha512 } from 'crypto-hash'; await sha512(data)",
-                documentationLink: 'https://www.npmjs.com/package/crypto-hash',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow SHA1 in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        let sha1ImportedFromCryptoHash = false;
-        return {
-            ImportDeclaration(node) {
-                if (isTestFile)
-                    return;
-                if (node.source.value === 'crypto-hash') {
-                    for (const specifier of node.specifiers) {
-                        if (specifier.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier &&
-                            specifier.imported.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            specifier.imported.name === 'sha1') {
-                            sha1ImportedFromCryptoHash = true;
-                            context.report({
-                                node: specifier,
-                                messageId: 'sha1Deprecated',
-                                suggest: [
-                                    {
-                                        messageId: 'useSha256',
-                                        fix: (fixer) => {
-                                            return fixer.replaceText(specifier.imported, 'sha256');
-                                        },
-                                    },
-                                    {
-                                        messageId: 'useSha512',
-                                        fix: (fixer) => {
-                                            return fixer.replaceText(specifier.imported, 'sha512');
-                                        },
-                                    },
-                                ],
-                            });
-                        }
-                    }
-                }
-            },
-            CallExpression(node) {
-                if (isTestFile)
-                    return;
-                if (sha1ImportedFromCryptoHash &&
-                    node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.name === 'sha1') {
-                    context.report({
-                        node,
-                        messageId: 'sha1Deprecated',
-                        suggest: [
-                            {
-                                messageId: 'useSha256',
-                                fix: (fixer) => {
-                                    return fixer.replaceText(node.callee, 'sha256');
-                                },
-                            },
-                        ],
-                    });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSha1Hash=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noSha1Hash=(0,eslint_devkit_1.createRule)({name:"no-sha1-hash",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-sha1-hash.md",description:"Disallow sha1() from crypto-hash package (use sha256 or sha512)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{sha1Deprecated:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"SHA-1 hash detected",cwe:"CWE-327",description:"SHA-1 is cryptographically broken and should not be used. The crypto-hash package itself warns against using sha1().",severity:"HIGH",fix:"Use sha256() or sha512() instead",documentationLink:"https://shattered.io/"}),useSha256:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use sha256",description:"SHA-256 provides adequate security for most use cases",severity:"LOW",fix:"import { sha256 } from 'crypto-hash'; await sha256(data)",documentationLink:"https://www.npmjs.com/package/crypto-hash"}),useSha512:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use sha512",description:"SHA-512 provides stronger security with longer hash",severity:"LOW",fix:"import { sha512 } from 'crypto-hash'; await sha512(data)",documentationLink:"https://www.npmjs.com/package/crypto-hash"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow SHA1 in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);let sha1ImportedFromCryptoHash=false;return{ImportDeclaration(node){if(isTestFile)return;if(node.source.value==="crypto-hash"){for(const specifier of node.specifiers){if(specifier.type===eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier&&specifier.imported.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&specifier.imported.name==="sha1"){sha1ImportedFromCryptoHash=true;context.report({node:specifier,messageId:"sha1Deprecated",suggest:[{messageId:"useSha256",fix:fixer=>{return fixer.replaceText(specifier.imported,"sha256")}},{messageId:"useSha512",fix:fixer=>{return fixer.replaceText(specifier.imported,"sha512")}}]})}}}},CallExpression(node){if(isTestFile)return;if(sha1ImportedFromCryptoHash&&node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="sha1"){context.report({node,messageId:"sha1Deprecated",suggest:[{messageId:"useSha256",fix:fixer=>{return fixer.replaceText(node.callee,"sha256")}}]})}}}}});

package/src/rules/no-shell-injection/index.js

@@ -1,68 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noShellInjection = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const SHELL_EXEC_FUNCTIONS = new Set([
-    'exec', 'execSync',
-]);
-function isStringConcatOrTemplate(node) {
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral && node.expressions.length > 0)
-        return true;
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression &&
-        node.operator === '+' &&
-        (node.left.type === eslint_devkit_1.AST_NODE_TYPES.Literal ||
-            node.left.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral ||
-            node.left.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression ||
-            node.right.type === eslint_devkit_1.AST_NODE_TYPES.Literal ||
-            node.right.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral))
-        return true;
-    return false;
-}
-exports.noShellInjection = (0, eslint_devkit_1.createRule)({
-    name: 'no-shell-injection',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-shell-injection.md',
-            description: 'Disallow string concatenation or template expressions in shell command arguments (CWE-78)',
-            cwe: 'CWE-78',
-            cvss: 9.8,
-        },
-        messages: {
-            shellInjection: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'OS Command Injection (CWE-78)',
-                cwe: 'CWE-78',
-                description: 'Shell command built via string concatenation or template literal. An attacker who controls any interpolated value can execute arbitrary OS commands.',
-                severity: 'CRITICAL',
-                fix: 'Use spawn(cmd, [arg1, arg2]) with separate arguments instead of exec(cmd + args). Never build shell commands via string interpolation.',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        return {
-            CallExpression(node) {
-                const callee = node.callee;
-                let fnName = null;
-                if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    fnName = callee.name;
-                }
-                else if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    fnName = callee.property.name;
-                }
-                if (!fnName || !SHELL_EXEC_FUNCTIONS.has(fnName))
-                    return;
-                const firstArg = node.arguments[0];
-                if (!firstArg || firstArg.type === eslint_devkit_1.AST_NODE_TYPES.SpreadElement)
-                    return;
-                if (isStringConcatOrTemplate(firstArg)) {
-                    context.report({ node: firstArg, messageId: 'shellInjection' });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noShellInjection=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const SHELL_EXEC_FUNCTIONS=new Set(["exec","execSync"]);function isStringConcatOrTemplate(node){if(node.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral&&node.expressions.length>0)return true;if(node.type===eslint_devkit_1.AST_NODE_TYPES.BinaryExpression&&node.operator==="+"&&(node.left.type===eslint_devkit_1.AST_NODE_TYPES.Literal||node.left.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral||node.left.type===eslint_devkit_1.AST_NODE_TYPES.BinaryExpression||node.right.type===eslint_devkit_1.AST_NODE_TYPES.Literal||node.right.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral))return true;return false}exports.noShellInjection=(0,eslint_devkit_1.createRule)({name:"no-shell-injection",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-shell-injection.md",description:"Disallow string concatenation or template expressions in shell command arguments (CWE-78)",cwe:"CWE-78",cvss:9.8},messages:{shellInjection:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"OS Command Injection (CWE-78)",cwe:"CWE-78",description:"Shell command built via string concatenation or template literal. An attacker who controls any interpolated value can execute arbitrary OS commands.",severity:"CRITICAL",fix:"Use spawn(cmd, [arg1, arg2]) with separate arguments instead of exec(cmd + args). Never build shell commands via string interpolation.",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"})},schema:[]},defaultOptions:[],create(context){return{CallExpression(node){const callee=node.callee;let fnName=null;if(callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){fnName=callee.name}else if(callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){fnName=callee.property.name}if(!fnName||!SHELL_EXEC_FUNCTIONS.has(fnName))return;const firstArg=node.arguments[0];if(!firstArg||firstArg.type===eslint_devkit_1.AST_NODE_TYPES.SpreadElement)return;if(isStringConcatOrTemplate(firstArg)){context.report({node:firstArg,messageId:"shellInjection"})}}}}});