eslint-plugin-node-security 4.8.0 → 4.8.1

package/src/rules/detect-eval-with-expression/index.js

@@ -1,364 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectEvalWithExpression = exports.generateRefactoringSteps = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const EVAL_PATTERNS = [
-    {
-        pattern: 'JSON\\.parse|parse\\(.*\\)',
-        category: 'json',
-        safeAlternative: 'JSON.parse()',
-        example: {
-            bad: 'eval(\'{"key": "\' + value + \'"}"\')',
-            good: 'JSON.parse(\'{"key": "\' + value + \'"}"\')'
-        },
-        effort: '2 minutes'
-    },
-    {
-        pattern: 'Math\\.|parseInt|parseFloat',
-        category: 'math',
-        safeAlternative: 'Math functions or parseInt/parseFloat',
-        example: {
-            bad: 'eval(\'Math.\' + method + \'(\' + arg + \')\')',
-            good: 'const mathMethods = {sin: Math.sin, cos: Math.cos}; mathMethods[method](arg)'
-        },
-        effort: '5 minutes'
-    },
-    {
-        pattern: '\\$\\{|template|interpolat',
-        category: 'template',
-        safeAlternative: 'Template literals or template engine',
-        example: {
-            bad: 'eval(\'Hello \' + userName + \'!\')',
-            good: 'const template = `Hello ${userName}!`;'
-        },
-        effort: '3 minutes'
-    },
-    {
-        pattern: '\\[.*\\]|object\\[|obj\\.|\\.',
-        category: 'object',
-        safeAlternative: 'Direct property access or Map',
-        example: {
-            bad: 'eval(\'obj.\' + property)',
-            good: 'const allowedProps = {name: true, age: true}; if (allowedProps[property]) obj[property]'
-        },
-        effort: '8 minutes'
-    }
-];
-const generateRefactoringSteps = (pattern) => {
-    if (!pattern) {
-        return [
-            '   1. Remove eval() usage entirely',
-            '   2. Identify what the code is trying to achieve',
-            '   3. Use appropriate safe alternative (JSON.parse, Map, etc.)',
-            '   4. Add input validation if dynamic behavior needed',
-            '   5. Test thoroughly for edge cases'
-        ].join('\n');
-    }
-    switch (pattern.category) {
-        case 'json':
-            return [
-                '   1. Replace eval() with JSON.parse()',
-                '   2. Ensure input is valid JSON string',
-                '   3. Add try/catch for JSON parsing errors',
-                '   4. Consider using a JSON schema validator'
-            ].join('\n');
-        case 'math':
-            return [
-                '   1. Create whitelist of allowed Math functions',
-                '   2. Use direct function calls: Math.sin(x)',
-                '   3. Validate inputs are numbers',
-                '   4. Consider using a math expression parser library'
-            ].join('\n');
-        case 'template':
-            return [
-                '   1. Use template literals: `Hello ${name}`',
-                '   2. Sanitize variables before interpolation',
-                '   3. Use a template engine like Handlebars if complex',
-                '   4. Validate template structure'
-            ].join('\n');
-        case 'object':
-            return [
-                '   1. Use Map or plain object for key-value access',
-                '   2. Whitelist allowed property names',
-                '   3. Use hasOwnProperty() check',
-                '   4. Consider Object.create(null) for clean objects'
-            ].join('\n');
-        default:
-            return [
-                '   1. Identify the specific use case',
-                '   2. Find a safer alternative approach',
-                '   3. Add comprehensive input validation',
-                '   4. Use static analysis if possible'
-            ].join('\n');
-    }
-};
-exports.generateRefactoringSteps = generateRefactoringSteps;
-exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
-    name: 'detect-eval-with-expression',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-eval-with-expression.md',
-            description: 'Detects eval(variable) which can allow an attacker to run arbitrary code',
-            cwe: 'CWE-95',
-            cvss: 9.8,
-            confidence: 'high',
-        },
-        messages: {
-            evalWithExpression: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() with dynamic code',
-                cwe: 'CWE-95',
-                description: 'eval() with dynamic code',
-                severity: 'CRITICAL',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useJsonParse: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for JSON parsing',
-                cwe: 'CWE-95',
-                description: 'Use JSON.parse() instead of eval() for JSON string parsing',
-                severity: 'HIGH',
-                fix: 'Replace eval() with JSON.parse()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useObjectAccess: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for property access',
-                cwe: 'CWE-95',
-                description: 'Use direct property access instead of eval() for dynamic property access',
-                severity: 'HIGH',
-                fix: 'Use obj[key] or Map.get(key) instead of eval()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useTemplateLiteral: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for string interpolation',
-                cwe: 'CWE-95',
-                description: 'Use template literals instead of eval() for string interpolation',
-                severity: 'HIGH',
-                fix: 'Replace eval() with template literals: `Hello ${name}`',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useFunctionConstructor: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for function creation',
-                cwe: 'CWE-95',
-                description: 'Use Function constructor with validation instead of eval()',
-                severity: 'HIGH',
-                fix: 'Replace eval() with validated Function constructor',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useSaferAlternative: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() usage detected',
-                cwe: 'CWE-95',
-                description: 'eval() with dynamic code execution detected',
-                severity: 'HIGH',
-                fix: '{{alternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyRemove: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Critical eval() security vulnerability',
-                cwe: 'CWE-95',
-                description: 'eval() usage poses severe security risk',
-                severity: 'CRITICAL',
-                fix: 'Remove eval() entirely - security risk too high',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyRefactor: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() refactoring required',
-                cwe: 'CWE-95',
-                description: 'eval() can be refactored to safer alternative',
-                severity: 'HIGH',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyValidate: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() input validation needed',
-                cwe: 'CWE-95',
-                description: 'eval() requires input validation for security',
-                severity: 'MEDIUM',
-                fix: 'Add input validation before using eval()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowLiteralStrings: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow eval with literal strings (false = stricter)'
-                    },
-                    additionalEvalFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional functions to treat as eval-like'
-                    },
-                    strategy: {
-                        type: 'string',
-                        enum: ['remove', 'refactor', 'validate', 'auto'],
-                        default: 'auto',
-                        description: 'Strategy for fixing eval usage (auto = smart detection)'
-                    }
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowLiteralStrings: false,
-            additionalEvalFunctions: [],
-            strategy: 'auto'
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { allowLiteralStrings = false, additionalEvalFunctions = [], strategy = 'auto' } = options;
-        const evalFunctions = new Set([
-            'eval',
-            'Function',
-            ...additionalEvalFunctions
-        ]);
-        const isLiteralString = (node) => {
-            return node.type === 'Literal' && typeof node.value === 'string';
-        };
-        const selectStrategyMessage = (pattern) => {
-            switch (strategy) {
-                case 'remove':
-                    return 'strategyRemove';
-                case 'refactor':
-                    return 'strategyRefactor';
-                case 'validate':
-                    return 'strategyValidate';
-                case 'auto':
-                default:
-                    if (pattern && pattern.category === 'json') {
-                        return 'useJsonParse';
-                    }
-                    if (pattern && pattern.category === 'object') {
-                        return 'useObjectAccess';
-                    }
-                    if (pattern && pattern.category === 'template') {
-                        return 'useTemplateLiteral';
-                    }
-                    return 'strategyRefactor';
-            }
-        };
-        const detectPattern = (expression) => {
-            for (const pattern of EVAL_PATTERNS) {
-                if (new RegExp(pattern.pattern, 'i').test(expression)) {
-                    return pattern;
-                }
-            }
-            return null;
-        };
-        const extractExpression = (node) => {
-            const sourceCode = context.sourceCode;
-            if (node.arguments.length > 0) {
-                return sourceCode.getText(node.arguments[0]);
-            }
-            return 'dynamic expression';
-        };
-        const checkCallExpression = (node) => {
-            if (node.callee.type === 'Identifier' &&
-                evalFunctions.has(node.callee.name)) {
-                if (allowLiteralStrings &&
-                    node.arguments.length > 0 &&
-                    isLiteralString(node.arguments[0])) {
-                    return;
-                }
-                if (node.arguments.length > 0 &&
-                    node.callee.name === 'eval' &&
-                    isLiteralString(node.arguments[0])) {
-                    return;
-                }
-                const expression = extractExpression(node);
-                const pattern = detectPattern(expression);
-                const steps = (0, exports.generateRefactoringSteps)(pattern);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression,
-                        patternCategory: pattern?.category || 'dynamic code execution',
-                        safeAlternative: pattern?.safeAlternative || 'Remove eval entirely',
-                        steps,
-                        effort: pattern?.effort || '15-30 minutes'
-                    },
-                    suggest: pattern ? [
-                        {
-                            messageId: strategyMessageId,
-                            data: {
-                                safeAlternative: pattern.safeAlternative,
-                                alternative: pattern.safeAlternative
-                            },
-                            fix: () => null
-                        }
-                    ] : undefined
-                });
-            }
-            if (node.callee.type === 'NewExpression' &&
-                node.callee.callee.type === 'Identifier' &&
-                node.callee.callee.name === 'Function') {
-                const expression = extractExpression(node);
-                const pattern = detectPattern(expression);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression: `new Function(${expression})`,
-                        patternCategory: 'function constructor',
-                        safeAlternative: 'Arrow function or regular function',
-                        steps: [
-                            '   1. Replace Function constructor with arrow function',
-                            '   2. Use regular function declaration',
-                            '   3. Validate any dynamic parts',
-                            '   4. Consider module imports instead'
-                        ].join('\n'),
-                        effort: '10 minutes'
-                    }
-                });
-            }
-        };
-        const checkNewExpression = (node) => {
-            if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
-                const sourceCode = context.sourceCode;
-                const expression = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
-                const pattern = detectPattern(expression);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression: `new Function(${expression})`,
-                        patternCategory: 'function constructor',
-                        safeAlternative: 'Arrow function or regular function',
-                        steps: [
-                            '   1. Replace Function constructor with arrow function',
-                            '   2. Use regular function declaration',
-                            '   3. Validate any dynamic parts',
-                            '   4. Consider module imports instead'
-                        ].join('\n'),
-                        effort: '10 minutes'
-                    }
-                });
-            }
-        };
-        return {
-            CallExpression: checkCallExpression,
-            NewExpression: checkNewExpression
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.detectEvalWithExpression=exports.generateRefactoringSteps=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const EVAL_PATTERNS=[{pattern:"JSON\\.parse|parse\\(.*\\)",category:"json",safeAlternative:"JSON.parse()",example:{bad:`eval('{"key": "' + value + '"}"')`,good:`JSON.parse('{"key": "' + value + '"}"')`},effort:"2 minutes"},{pattern:"Math\\.|parseInt|parseFloat",category:"math",safeAlternative:"Math functions or parseInt/parseFloat",example:{bad:"eval('Math.' + method + '(' + arg + ')')",good:"const mathMethods = {sin: Math.sin, cos: Math.cos}; mathMethods[method](arg)"},effort:"5 minutes"},{pattern:"\\$\\{|template|interpolat",category:"template",safeAlternative:"Template literals or template engine",example:{bad:"eval('Hello ' + userName + '!')",good:"const template = `Hello ${userName}!`;"},effort:"3 minutes"},{pattern:"\\[.*\\]|object\\[|obj\\.|\\.",category:"object",safeAlternative:"Direct property access or Map",example:{bad:"eval('obj.' + property)",good:"const allowedProps = {name: true, age: true}; if (allowedProps[property]) obj[property]"},effort:"8 minutes"}];const generateRefactoringSteps=pattern=>{if(!pattern){return["   1. Remove eval() usage entirely","   2. Identify what the code is trying to achieve","   3. Use appropriate safe alternative (JSON.parse, Map, etc.)","   4. Add input validation if dynamic behavior needed","   5. Test thoroughly for edge cases"].join("\n")}switch(pattern.category){case"json":return["   1. Replace eval() with JSON.parse()","   2. Ensure input is valid JSON string","   3. Add try/catch for JSON parsing errors","   4. Consider using a JSON schema validator"].join("\n");case"math":return["   1. Create whitelist of allowed Math functions","   2. Use direct function calls: Math.sin(x)","   3. Validate inputs are numbers","   4. Consider using a math expression parser library"].join("\n");case"template":return["   1. Use template literals: `Hello ${name}`","   2. Sanitize variables before interpolation","   3. Use a template engine like Handlebars if complex","   4. Validate template structure"].join("\n");case"object":return["   1. Use Map or plain object for key-value access","   2. Whitelist allowed property names","   3. Use hasOwnProperty() check","   4. Consider Object.create(null) for clean objects"].join("\n");default:return["   1. Identify the specific use case","   2. Find a safer alternative approach","   3. Add comprehensive input validation","   4. Use static analysis if possible"].join("\n")}};exports.generateRefactoringSteps=generateRefactoringSteps;exports.detectEvalWithExpression=(0,eslint_devkit_2.createRule)({name:"detect-eval-with-expression",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-eval-with-expression.md",description:"Detects eval(variable) which can allow an attacker to run arbitrary code",cwe:"CWE-95",cvss:9.8,confidence:"high"},messages:{evalWithExpression:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"eval() with dynamic code",cwe:"CWE-95",description:"eval() with dynamic code",severity:"CRITICAL",fix:"{{safeAlternative}}",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),useJsonParse:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe eval() for JSON parsing",cwe:"CWE-95",description:"Use JSON.parse() instead of eval() for JSON string parsing",severity:"HIGH",fix:"Replace eval() with JSON.parse()",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),useObjectAccess:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe eval() for property access",cwe:"CWE-95",description:"Use direct property access instead of eval() for dynamic property access",severity:"HIGH",fix:"Use obj[key] or Map.get(key) instead of eval()",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),useTemplateLiteral:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe eval() for string interpolation",cwe:"CWE-95",description:"Use template literals instead of eval() for string interpolation",severity:"HIGH",fix:"Replace eval() with template literals: `Hello ${name}`",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),useFunctionConstructor:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe eval() for function creation",cwe:"CWE-95",description:"Use Function constructor with validation instead of eval()",severity:"HIGH",fix:"Replace eval() with validated Function constructor",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),useSaferAlternative:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe eval() usage detected",cwe:"CWE-95",description:"eval() with dynamic code execution detected",severity:"HIGH",fix:"{{alternative}}",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),strategyRemove:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Critical eval() security vulnerability",cwe:"CWE-95",description:"eval() usage poses severe security risk",severity:"CRITICAL",fix:"Remove eval() entirely - security risk too high",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),strategyRefactor:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"eval() refactoring required",cwe:"CWE-95",description:"eval() can be refactored to safer alternative",severity:"HIGH",fix:"{{safeAlternative}}",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"}),strategyValidate:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"eval() input validation needed",cwe:"CWE-95",description:"eval() requires input validation for security",severity:"MEDIUM",fix:"Add input validation before using eval()",documentationLink:"https://owasp.org/www-community/attacks/Code_Injection"})},schema:[{type:"object",properties:{allowLiteralStrings:{type:"boolean",default:false,description:"Allow eval with literal strings (false = stricter)"},additionalEvalFunctions:{type:"array",items:{type:"string"},default:[],description:"Additional functions to treat as eval-like"},strategy:{type:"string",enum:["remove","refactor","validate","auto"],default:"auto",description:"Strategy for fixing eval usage (auto = smart detection)"}},additionalProperties:false}]},defaultOptions:[{allowLiteralStrings:false,additionalEvalFunctions:[],strategy:"auto"}],create(context){const options=context.options[0]||{};const{allowLiteralStrings=false,additionalEvalFunctions=[],strategy="auto"}=options;const evalFunctions=new Set(["eval","Function",...additionalEvalFunctions]);const isLiteralString=node=>{return node.type==="Literal"&&typeof node.value==="string"};const selectStrategyMessage=pattern=>{switch(strategy){case"remove":return"strategyRemove";case"refactor":return"strategyRefactor";case"validate":return"strategyValidate";case"auto":default:if(pattern&&pattern.category==="json"){return"useJsonParse"}if(pattern&&pattern.category==="object"){return"useObjectAccess"}if(pattern&&pattern.category==="template"){return"useTemplateLiteral"}return"strategyRefactor"}};const detectPattern=expression=>{for(const pattern of EVAL_PATTERNS){if(new RegExp(pattern.pattern,"i").test(expression)){return pattern}}return null};const extractExpression=node=>{const sourceCode=context.sourceCode;if(node.arguments.length>0){return sourceCode.getText(node.arguments[0])}return"dynamic expression"};const checkCallExpression=node=>{if(node.callee.type==="Identifier"&&evalFunctions.has(node.callee.name)){if(allowLiteralStrings&&node.arguments.length>0&&isLiteralString(node.arguments[0])){return}if(node.arguments.length>0&&node.callee.name==="eval"&&isLiteralString(node.arguments[0])){return}const expression=extractExpression(node);const pattern=detectPattern(expression);const steps=(0,exports.generateRefactoringSteps)(pattern);const strategyMessageId=selectStrategyMessage(pattern);context.report({node,messageId:strategyMessageId,data:{expression,patternCategory:pattern?.category||"dynamic code execution",safeAlternative:pattern?.safeAlternative||"Remove eval entirely",steps,effort:pattern?.effort||"15-30 minutes"},suggest:pattern?[{messageId:strategyMessageId,data:{safeAlternative:pattern.safeAlternative,alternative:pattern.safeAlternative},fix:()=>null}]:void 0})}if(node.callee.type==="NewExpression"&&node.callee.callee.type==="Identifier"&&node.callee.callee.name==="Function"){const expression=extractExpression(node);const pattern=detectPattern(expression);const strategyMessageId=selectStrategyMessage(pattern);context.report({node,messageId:strategyMessageId,data:{expression:`new Function(${expression})`,patternCategory:"function constructor",safeAlternative:"Arrow function or regular function",steps:["   1. Replace Function constructor with arrow function","   2. Use regular function declaration","   3. Validate any dynamic parts","   4. Consider module imports instead"].join("\n"),effort:"10 minutes"}})}};const checkNewExpression=node=>{if(node.callee.type==="Identifier"&&node.callee.name==="Function"){const sourceCode=context.sourceCode;const expression=node.arguments.map(arg=>sourceCode.getText(arg)).join(", ");const pattern=detectPattern(expression);const strategyMessageId=selectStrategyMessage(pattern);context.report({node,messageId:strategyMessageId,data:{expression:`new Function(${expression})`,patternCategory:"function constructor",safeAlternative:"Arrow function or regular function",steps:["   1. Replace Function constructor with arrow function","   2. Use regular function declaration","   3. Validate any dynamic parts","   4. Consider module imports instead"].join("\n"),effort:"10 minutes"}})}};return{CallExpression:checkCallExpression,NewExpression:checkNewExpression}}});