eslint-plugin-node-security 4.8.0 → 4.8.1

package/src/rules/no-buffer-overread/index.js

@@ -1,543 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noBufferOverread = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
-    name: 'no-buffer-overread',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-buffer-overread.md',
-            description: 'Detects buffer access beyond bounds',
-            cwe: 'CWE-126',
-        },
-        hasSuggestions: true,
-        messages: {
-            bufferOverread: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Buffer Overread',
-                cwe: 'CWE-126',
-                description: 'Buffer access beyond allocated bounds',
-                severity: '{{severity}}',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
-            }),
-            unsafeBufferAccess: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe Buffer Access',
-                cwe: 'CWE-126',
-                description: 'Buffer accessed without bounds validation',
-                severity: 'HIGH',
-                fix: 'Add bounds check before buffer access',
-                documentationLink: 'https://nodejs.org/api/buffer.html',
-            }),
-            missingBoundsCheck: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Bounds Check',
-                cwe: 'CWE-126',
-                description: 'Buffer operation missing bounds validation',
-                severity: 'MEDIUM',
-                fix: 'Validate indices before buffer operations',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
-            }),
-            negativeBufferIndex: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Negative Buffer Index',
-                cwe: 'CWE-126',
-                description: 'Negative index used for buffer access',
-                severity: 'MEDIUM',
-                fix: 'Ensure buffer indices are non-negative',
-                documentationLink: 'https://nodejs.org/api/buffer.html',
-            }),
-            userControlledBufferIndex: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'User Controlled Buffer Index',
-                cwe: 'CWE-126',
-                description: 'Buffer accessed with user-controlled index',
-                severity: 'HIGH',
-                fix: 'Validate user input before using as buffer index',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
-            }),
-            unsafeBufferSlice: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe Buffer Slice',
-                cwe: 'CWE-126',
-                description: 'Buffer slice with unvalidated indices',
-                severity: 'MEDIUM',
-                fix: 'Validate slice start/end indices',
-                documentationLink: 'https://nodejs.org/api/buffer.html#bufslicestart-end',
-            }),
-            bufferLengthNotChecked: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Buffer Length Not Checked',
-                cwe: 'CWE-126',
-                description: 'Buffer length not validated before access',
-                severity: 'MEDIUM',
-                fix: 'Check buffer.length before operations',
-                documentationLink: 'https://nodejs.org/api/buffer.html#buflength',
-            }),
-            useSafeBufferAccess: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Safe Buffer Access',
-                description: 'Use bounds-checked buffer access methods',
-                severity: 'LOW',
-                fix: 'Use buffer.read*() with offset validation or safe wrapper functions',
-                documentationLink: 'https://nodejs.org/api/buffer.html',
-            }),
-            validateBufferIndices: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Validate Buffer Indices',
-                description: 'Validate buffer indices before use',
-                severity: 'LOW',
-                fix: 'Check 0 <= index < buffer.length',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
-            }),
-            checkBufferBounds: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Check Buffer Bounds',
-                description: 'Always check buffer bounds',
-                severity: 'LOW',
-                fix: 'Validate buffer operations against buffer.length',
-                documentationLink: 'https://nodejs.org/api/buffer.html#buflength',
-            }),
-            strategyBoundsChecking: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Bounds Checking Strategy',
-                description: 'Implement comprehensive bounds checking',
-                severity: 'LOW',
-                fix: 'Validate all buffer indices and lengths before operations',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
-            }),
-            strategyInputValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Input Validation Strategy',
-                description: 'Validate user input used as buffer indices',
-                severity: 'LOW',
-                fix: 'Sanitize and validate all user input before buffer operations',
-                documentationLink: 'https://nodejs.org/api/buffer.html',
-            }),
-            strategySafeBuffers: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.STRATEGY,
-                issueName: 'Safe Buffer Strategy',
-                description: 'Use safe buffer wrapper libraries',
-                severity: 'LOW',
-                fix: 'Use libraries that provide bounds-checked buffer operations',
-                documentationLink: 'https://www.npmjs.com/package/safe-buffer',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    bufferMethods: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], description: 'Buffer read/write methods checked for bounds'
-                    },
-                    boundsCheckFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], description: 'Function names that count as a bounds check'
-                    },
-                    bufferTypes: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], description: 'Constructor names treated as buffer types'
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional function names to consider as buffer index validators',
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional JSDoc annotations to consider as safe markers',
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Disable all false positive detection (strict mode)',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            bufferMethods: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'],
-            boundsCheckFunctions: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'],
-            bufferTypes: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { bufferMethods = ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], boundsCheckFunctions = ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], bufferTypes = ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
-        const sourceCode = context.sourceCode;
-        const filename = context.filename;
-        const safetyChecker = (0, eslint_devkit_1.createSafetyChecker)({
-            trustedSanitizers,
-            trustedAnnotations,
-            trustedOrmPatterns: [],
-            strictMode,
-        });
-        const bufferTypesSet = new Set(bufferTypes.map(t => t.toLowerCase()));
-        const userControlledKeywords = new Set(['req', 'request', 'query', 'params', 'input', 'user', 'offset', 'index', 'body']);
-        const bufferVars = new Set();
-        const isBufferType = (varName) => {
-            if (bufferVars.has(varName))
-                return true;
-            const lowerName = varName.toLowerCase();
-            for (const type of bufferTypesSet) {
-                if (lowerName.includes(type))
-                    return true;
-            }
-            if (lowerName === 'buf' || lowerName === 'bytes')
-                return true;
-            return false;
-        };
-        const isUserControlledIndex = (indexNode) => {
-            if (indexNode.type === 'MemberExpression') {
-                let walker = indexNode;
-                while (walker.type === 'MemberExpression') {
-                    walker = walker.object;
-                }
-                if (walker.type === 'Identifier') {
-                    const root = walker.name.toLowerCase();
-                    if (['req', 'request', 'event', 'ctx', 'context'].includes(root)) {
-                        return true;
-                    }
-                    for (const keyword of userControlledKeywords) {
-                        if (root.includes(keyword))
-                            return true;
-                    }
-                }
-            }
-            if (indexNode.type === 'Identifier') {
-                const varName = indexNode.name.toLowerCase();
-                for (const keyword of userControlledKeywords) {
-                    if (varName.includes(keyword))
-                        return true;
-                }
-                let currentScope = sourceCode.getScope(indexNode);
-                let variable = null;
-                while (currentScope) {
-                    variable = currentScope.variables.find(v => v.name === indexNode.name) || null;
-                    if (variable)
-                        break;
-                    currentScope = currentScope.upper;
-                }
-                if (variable && variable.defs.length > 0) {
-                    const def = variable.defs[0];
-                    if (def.type === 'Variable' && def.node.init) {
-                        const init = def.node.init;
-                        if (init.type === 'MemberExpression') {
-                            const objectText = sourceCode.getText(init.object).toLowerCase();
-                            const propertyText = sourceCode.getText(init.property).toLowerCase();
-                            const keywords = ['req', 'request', 'query', 'params', 'input', 'user', 'body'];
-                            if (keywords.some(k => objectText.includes(k) || propertyText.includes(k))) {
-                                return true;
-                            }
-                        }
-                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                            const typeConversionFunctions = ['number', 'parseint', 'parsefloat', 'string', 'boolean'];
-                            let isTypeConversion = false;
-                            if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                                isTypeConversion = typeConversionFunctions.includes(init.callee.name.toLowerCase());
-                            }
-                            if (isTypeConversion && init.arguments.length > 0) {
-                                return isUserControlledIndex(init.arguments[0]);
-                            }
-                        }
-                        if (init.type === 'Identifier' && init.name !== indexNode.name) {
-                            return isUserControlledIndex(init);
-                        }
-                    }
-                }
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                const typeConversionFunctions = ['Number', 'parseInt', 'parseFloat', 'String', 'Boolean'];
-                if (indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    typeConversionFunctions.includes(indexNode.callee.name)) {
-                    for (const arg of indexNode.arguments) {
-                        if (isUserControlledIndex(arg)) {
-                            return true;
-                        }
-                    }
-                }
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
-                const text = sourceCode.getText(indexNode).toLowerCase();
-                const keywords = ['req.', 'request.', 'query.', 'params.', 'body.', 'input.', 'user.'];
-                if (keywords.some(k => text.includes(k))) {
-                    return true;
-                }
-            }
-            return false;
-        };
-        const isIndexValidated = (indexNode) => {
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
-                return indexNode.value >= 0;
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                let current = indexNode;
-                while (current) {
-                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator &&
-                        current.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                        current.id.name === indexNode.name &&
-                        current.init) {
-                        const init = current.init;
-                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                            init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            boundsCheckFunctions.includes(init.callee.name)) {
-                            return true;
-                        }
-                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                            init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                            init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            init.callee.object.name === 'Math' &&
-                            init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            (init.callee.property.name === 'min' || init.callee.property.name === 'max')) {
-                            return true;
-                        }
-                        break;
-                    }
-                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
-                        current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
-                        current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
-                        const params = current.params;
-                        for (const param of params) {
-                            if (param.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && param.name === indexNode.name) {
-                                return true;
-                            }
-                        }
-                    }
-                    current = current.parent;
-                }
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                boundsCheckFunctions.includes(indexNode.callee.name)) {
-                return true;
-            }
-            return false;
-        };
-        const hasBoundsCheck = (bufferName, indexNode) => {
-            let current = indexNode;
-            while (current) {
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
-                    current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
-                    current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
-                    break;
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                    const condition = current.test;
-                    const conditionText = sourceCode.getText(condition).toLowerCase();
-                    if (conditionText.includes(`${bufferName}.length`) &&
-                        (conditionText.includes('<') || conditionText.includes('<=') ||
-                            conditionText.includes('>') || conditionText.includes('>=') ||
-                            conditionText.includes('&&') || conditionText.includes('||'))) {
-                        return true;
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclaration) {
-                    for (const declarator of current.declarations) {
-                        if (declarator.init) {
-                            const initText = sourceCode.getText(declarator.init).toLowerCase();
-                            if (initText.includes(`${bufferName}.length`) &&
-                                (initText.includes('math.min') || initText.includes('math.max') ||
-                                    initText.includes('mathmin') || initText.includes('mathmax'))) {
-                                return true;
-                            }
-                        }
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement && current.argument) {
-                    const returnText = sourceCode.getText(current.argument).toLowerCase();
-                    if (returnText.includes(`${bufferName}.length`)) {
-                        return true;
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        };
-        const couldBeNegative = (indexNode) => {
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
-                return indexNode.value < 0;
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
-                indexNode.operator === '-' &&
-                indexNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                typeof indexNode.argument.value === 'number') {
-                return true;
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression && indexNode.operator === '-') {
-                return true;
-            }
-            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                let current = indexNode;
-                while (current) {
-                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator && current.init) {
-                        if (current.init.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                            typeof current.init.value === 'number' &&
-                            current.init.value < 0) {
-                            return true;
-                        }
-                        if (current.init.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
-                            current.init.operator === '-' &&
-                            current.init.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-                            typeof current.init.argument.value === 'number') {
-                            return true;
-                        }
-                    }
-                    current = current.parent;
-                }
-            }
-            return false;
-        };
-        return {
-            VariableDeclarator(node) {
-                if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && node.init) {
-                    const varName = node.id.name;
-                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
-                        node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                        bufferTypes.includes(node.init.callee.name)) {
-                        bufferVars.add(varName);
-                    }
-                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                        node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                        node.init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                        node.init.callee.object.name === 'Buffer' &&
-                        node.init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                        ['from', 'alloc', 'allocUnsafe'].includes(node.init.callee.property.name)) {
-                        bufferVars.add(varName);
-                    }
-                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                        const callee = node.init.callee;
-                        if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                            callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                            bufferMethods.includes(callee.property.name)) {
-                            bufferVars.add(varName);
-                        }
-                    }
-                    if (bufferTypes.some(type => varName.toLowerCase().includes(type.toLowerCase()))) {
-                        bufferVars.add(varName);
-                    }
-                }
-            },
-            MemberExpression(node) {
-                if (node.computed && node.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    const bufferName = node.object.name;
-                    const indexNode = node.property;
-                    if (isBufferType(bufferName)) {
-                        if (couldBeNegative(indexNode)) {
-                            context.report({
-                                node,
-                                messageId: 'negativeBufferIndex',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                            return;
-                        }
-                        if (isUserControlledIndex(indexNode) && !isIndexValidated(indexNode)) {
-                            if (!hasBoundsCheck(bufferName, indexNode)) {
-                                if (safetyChecker.isSafe(node, context)) {
-                                    return;
-                                }
-                                context.report({
-                                    node,
-                                    messageId: 'userControlledBufferIndex',
-                                    data: {
-                                        filePath: filename,
-                                        line: String(node.loc?.start.line ?? 0),
-                                    },
-                                });
-                                return;
-                            }
-                        }
-                        if (!hasBoundsCheck(bufferName, indexNode) && !isIndexValidated(indexNode)) {
-                            if (safetyChecker.isSafe(node, context)) {
-                                return;
-                            }
-                            context.report({
-                                node,
-                                messageId: 'unsafeBufferAccess',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                }
-                if (node.property.type === 'Identifier' &&
-                    bufferMethods.includes(node.property.name) &&
-                    node.object.type === 'Identifier' &&
-                    isBufferType(node.object.name)) {
-                }
-            },
-            CallExpression(node) {
-                const callee = node.callee;
-                if (callee.type === 'MemberExpression' &&
-                    callee.property.type === 'Identifier' &&
-                    callee.property.name === 'slice' &&
-                    callee.object.type === 'Identifier' &&
-                    isBufferType(callee.object.name)) {
-                    const args = node.arguments;
-                    for (const arg of args) {
-                        if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
-                            if (safetyChecker.isSafe(node, context)) {
-                                continue;
-                            }
-                            context.report({
-                                node: arg,
-                                messageId: 'unsafeBufferSlice',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                }
-                if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    bufferMethods.includes(callee.property.name) &&
-                    callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    isBufferType(callee.object.name)) {
-                    const args = node.arguments;
-                    for (const arg of args) {
-                        if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
-                            if (safetyChecker.isSafe(node, context)) {
-                                continue;
-                            }
-                            context.report({
-                                node: arg,
-                                messageId: 'missingBoundsCheck',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                }
-            },
-            BinaryExpression(node) {
-                const leftText = sourceCode.getText(node.left);
-                const rightText = sourceCode.getText(node.right);
-                if (leftText.includes('.length') || rightText.includes('.length')) {
-                }
-            }
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noBufferOverread=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noBufferOverread=(0,eslint_devkit_1.createRule)({name:"no-buffer-overread",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-buffer-overread.md",description:"Detects buffer access beyond bounds",cwe:"CWE-126"},hasSuggestions:true,messages:{bufferOverread:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Buffer Overread",cwe:"CWE-126",description:"Buffer access beyond allocated bounds",severity:"{{severity}}",fix:"{{safeAlternative}}",documentationLink:"https://cwe.mitre.org/data/definitions/126.html"}),unsafeBufferAccess:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe Buffer Access",cwe:"CWE-126",description:"Buffer accessed without bounds validation",severity:"HIGH",fix:"Add bounds check before buffer access",documentationLink:"https://nodejs.org/api/buffer.html"}),missingBoundsCheck:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Missing Bounds Check",cwe:"CWE-126",description:"Buffer operation missing bounds validation",severity:"MEDIUM",fix:"Validate indices before buffer operations",documentationLink:"https://cwe.mitre.org/data/definitions/126.html"}),negativeBufferIndex:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Negative Buffer Index",cwe:"CWE-126",description:"Negative index used for buffer access",severity:"MEDIUM",fix:"Ensure buffer indices are non-negative",documentationLink:"https://nodejs.org/api/buffer.html"}),userControlledBufferIndex:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"User Controlled Buffer Index",cwe:"CWE-126",description:"Buffer accessed with user-controlled index",severity:"HIGH",fix:"Validate user input before using as buffer index",documentationLink:"https://cwe.mitre.org/data/definitions/126.html"}),unsafeBufferSlice:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Unsafe Buffer Slice",cwe:"CWE-126",description:"Buffer slice with unvalidated indices",severity:"MEDIUM",fix:"Validate slice start/end indices",documentationLink:"https://nodejs.org/api/buffer.html#bufslicestart-end"}),bufferLengthNotChecked:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Buffer Length Not Checked",cwe:"CWE-126",description:"Buffer length not validated before access",severity:"MEDIUM",fix:"Check buffer.length before operations",documentationLink:"https://nodejs.org/api/buffer.html#buflength"}),useSafeBufferAccess:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Safe Buffer Access",description:"Use bounds-checked buffer access methods",severity:"LOW",fix:"Use buffer.read*() with offset validation or safe wrapper functions",documentationLink:"https://nodejs.org/api/buffer.html"}),validateBufferIndices:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Validate Buffer Indices",description:"Validate buffer indices before use",severity:"LOW",fix:"Check 0 <= index < buffer.length",documentationLink:"https://cwe.mitre.org/data/definitions/126.html"}),checkBufferBounds:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Check Buffer Bounds",description:"Always check buffer bounds",severity:"LOW",fix:"Validate buffer operations against buffer.length",documentationLink:"https://nodejs.org/api/buffer.html#buflength"}),strategyBoundsChecking:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Bounds Checking Strategy",description:"Implement comprehensive bounds checking",severity:"LOW",fix:"Validate all buffer indices and lengths before operations",documentationLink:"https://cwe.mitre.org/data/definitions/126.html"}),strategyInputValidation:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Input Validation Strategy",description:"Validate user input used as buffer indices",severity:"LOW",fix:"Sanitize and validate all user input before buffer operations",documentationLink:"https://nodejs.org/api/buffer.html"}),strategySafeBuffers:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Safe Buffer Strategy",description:"Use safe buffer wrapper libraries",severity:"LOW",fix:"Use libraries that provide bounds-checked buffer operations",documentationLink:"https://www.npmjs.com/package/safe-buffer"})},schema:[{type:"object",properties:{bufferMethods:{type:"array",items:{type:"string"},default:["readUInt8","readUInt16LE","readUInt32LE","readInt8","readInt16LE","readInt32LE","writeUInt8","writeUInt16LE","writeUInt32LE","slice","copy"],description:"Buffer read/write methods checked for bounds"},boundsCheckFunctions:{type:"array",items:{type:"string"},default:["validateIndex","checkBounds","safeIndex","validateBufferIndex"],description:"Function names that count as a bounds check"},bufferTypes:{type:"array",items:{type:"string"},default:["Buffer","Uint8Array","ArrayBuffer","DataView"],description:"Constructor names treated as buffer types"},trustedSanitizers:{type:"array",items:{type:"string"},default:[],description:"Additional function names to consider as buffer index validators"},trustedAnnotations:{type:"array",items:{type:"string"},default:[],description:"Additional JSDoc annotations to consider as safe markers"},strictMode:{type:"boolean",default:false,description:"Disable all false positive detection (strict mode)"}},additionalProperties:false}]},defaultOptions:[{bufferMethods:["readUInt8","readUInt16LE","readUInt32LE","readInt8","readInt16LE","readInt32LE","writeUInt8","writeUInt16LE","writeUInt32LE","slice","copy"],boundsCheckFunctions:["validateIndex","checkBounds","safeIndex","validateBufferIndex"],bufferTypes:["Buffer","Uint8Array","ArrayBuffer","DataView"],trustedSanitizers:[],trustedAnnotations:[],strictMode:false}],create(context){const options=context.options[0]||{};const{bufferMethods=["readUInt8","readUInt16LE","readUInt32LE","readInt8","readInt16LE","readInt32LE","writeUInt8","writeUInt16LE","writeUInt32LE","slice","copy"],boundsCheckFunctions=["validateIndex","checkBounds","safeIndex","validateBufferIndex"],bufferTypes=["Buffer","Uint8Array","ArrayBuffer","DataView"],trustedSanitizers=[],trustedAnnotations=[],strictMode=false}=options;const sourceCode=context.sourceCode;const filename=context.filename;const safetyChecker=(0,eslint_devkit_1.createSafetyChecker)({trustedSanitizers,trustedAnnotations,trustedOrmPatterns:[],strictMode});const bufferTypesSet=new Set(bufferTypes.map(t=>t.toLowerCase()));const userControlledKeywords=new Set(["req","request","query","params","input","user","offset","index","body"]);const bufferVars=new Set;const isBufferType=varName=>{if(bufferVars.has(varName))return true;const lowerName=varName.toLowerCase();for(const type of bufferTypesSet){if(lowerName.includes(type))return true}if(lowerName==="buf"||lowerName==="bytes")return true;return false};const isUserControlledIndex=indexNode=>{if(indexNode.type==="MemberExpression"){let walker=indexNode;while(walker.type==="MemberExpression"){walker=walker.object}if(walker.type==="Identifier"){const root=walker.name.toLowerCase();if(["req","request","event","ctx","context"].includes(root)){return true}for(const keyword of userControlledKeywords){if(root.includes(keyword))return true}}}if(indexNode.type==="Identifier"){const varName=indexNode.name.toLowerCase();for(const keyword of userControlledKeywords){if(varName.includes(keyword))return true}let currentScope=sourceCode.getScope(indexNode);let variable=null;while(currentScope){variable=currentScope.variables.find(v=>v.name===indexNode.name)||null;if(variable)break;currentScope=currentScope.upper}if(variable&&variable.defs.length>0){const def=variable.defs[0];if(def.type==="Variable"&&def.node.init){const init=def.node.init;if(init.type==="MemberExpression"){const objectText=sourceCode.getText(init.object).toLowerCase();const propertyText=sourceCode.getText(init.property).toLowerCase();const keywords=["req","request","query","params","input","user","body"];if(keywords.some(k=>objectText.includes(k)||propertyText.includes(k))){return true}}if(init.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){const typeConversionFunctions=["number","parseint","parsefloat","string","boolean"];let isTypeConversion=false;if(init.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){isTypeConversion=typeConversionFunctions.includes(init.callee.name.toLowerCase())}if(isTypeConversion&&init.arguments.length>0){return isUserControlledIndex(init.arguments[0])}}if(init.type==="Identifier"&&init.name!==indexNode.name){return isUserControlledIndex(init)}}}}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){const typeConversionFunctions=["Number","parseInt","parseFloat","String","Boolean"];if(indexNode.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&typeConversionFunctions.includes(indexNode.callee.name)){for(const arg of indexNode.arguments){if(isUserControlledIndex(arg)){return true}}}}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression){const text=sourceCode.getText(indexNode).toLowerCase();const keywords=["req.","request.","query.","params.","body.","input.","user."];if(keywords.some(k=>text.includes(k))){return true}}return false};const isIndexValidated=indexNode=>{if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof indexNode.value==="number"){return indexNode.value>=0}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){let current=indexNode;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator&&current.id.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&current.id.name===indexNode.name&&current.init){const init=current.init;if(init.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&init.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&boundsCheckFunctions.includes(init.callee.name)){return true}if(init.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&init.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&init.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&init.callee.object.name==="Math"&&init.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(init.callee.property.name==="min"||init.callee.property.name==="max")){return true}break}if(current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionExpression||current.type===eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression){const params=current.params;for(const param of params){if(param.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&param.name===indexNode.name){return true}}}current=current.parent}}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&indexNode.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&boundsCheckFunctions.includes(indexNode.callee.name)){return true}return false};const hasBoundsCheck=(bufferName,indexNode)=>{let current=indexNode;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||current.type===eslint_devkit_1.AST_NODE_TYPES.FunctionExpression||current.type===eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression){break}if(current.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement){const condition=current.test;const conditionText=sourceCode.getText(condition).toLowerCase();if(conditionText.includes(`${bufferName}.length`)&&(conditionText.includes("<")||conditionText.includes("<=")||conditionText.includes(">")||conditionText.includes(">=")||conditionText.includes("&&")||conditionText.includes("||"))){return true}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.VariableDeclaration){for(const declarator of current.declarations){if(declarator.init){const initText=sourceCode.getText(declarator.init).toLowerCase();if(initText.includes(`${bufferName}.length`)&&(initText.includes("math.min")||initText.includes("math.max")||initText.includes("mathmin")||initText.includes("mathmax"))){return true}}}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement&&current.argument){const returnText=sourceCode.getText(current.argument).toLowerCase();if(returnText.includes(`${bufferName}.length`)){return true}}current=current.parent}return false};const couldBeNegative=indexNode=>{if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof indexNode.value==="number"){return indexNode.value<0}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.UnaryExpression&&indexNode.operator==="-"&&indexNode.argument.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof indexNode.argument.value==="number"){return true}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.BinaryExpression&&indexNode.operator==="-"){return true}if(indexNode.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){let current=indexNode;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator&&current.init){if(current.init.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof current.init.value==="number"&&current.init.value<0){return true}if(current.init.type===eslint_devkit_1.AST_NODE_TYPES.UnaryExpression&&current.init.operator==="-"&&current.init.argument.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof current.init.argument.value==="number"){return true}}current=current.parent}}return false};return{VariableDeclarator(node){if(node.id.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.init){const varName=node.id.name;if(node.init.type===eslint_devkit_1.AST_NODE_TYPES.NewExpression&&node.init.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&bufferTypes.includes(node.init.callee.name)){bufferVars.add(varName)}if(node.init.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&node.init.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.init.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.init.callee.object.name==="Buffer"&&node.init.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&["from","alloc","allocUnsafe"].includes(node.init.callee.property.name)){bufferVars.add(varName)}if(node.init.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){const callee=node.init.callee;if(callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&bufferMethods.includes(callee.property.name)){bufferVars.add(varName)}}if(bufferTypes.some(type=>varName.toLowerCase().includes(type.toLowerCase()))){bufferVars.add(varName)}}},MemberExpression(node){if(node.computed&&node.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const bufferName=node.object.name;const indexNode=node.property;if(isBufferType(bufferName)){if(couldBeNegative(indexNode)){context.report({node,messageId:"negativeBufferIndex",data:{filePath:filename,line:String(node.loc?.start.line??0)}});return}if(isUserControlledIndex(indexNode)&&!isIndexValidated(indexNode)){if(!hasBoundsCheck(bufferName,indexNode)){if(safetyChecker.isSafe(node,context)){return}context.report({node,messageId:"userControlledBufferIndex",data:{filePath:filename,line:String(node.loc?.start.line??0)}});return}}if(!hasBoundsCheck(bufferName,indexNode)&&!isIndexValidated(indexNode)){if(safetyChecker.isSafe(node,context)){return}context.report({node,messageId:"unsafeBufferAccess",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}}if(node.property.type==="Identifier"&&bufferMethods.includes(node.property.name)&&node.object.type==="Identifier"&&isBufferType(node.object.name)){}},CallExpression(node){const callee=node.callee;if(callee.type==="MemberExpression"&&callee.property.type==="Identifier"&&callee.property.name==="slice"&&callee.object.type==="Identifier"&&isBufferType(callee.object.name)){const args=node.arguments;for(const arg of args){if(isUserControlledIndex(arg)&&!isIndexValidated(arg)){if(safetyChecker.isSafe(node,context)){continue}context.report({node:arg,messageId:"unsafeBufferSlice",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}}if(callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&bufferMethods.includes(callee.property.name)&&callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&isBufferType(callee.object.name)){const args=node.arguments;for(const arg of args){if(isUserControlledIndex(arg)&&!isIndexValidated(arg)){if(safetyChecker.isSafe(node,context)){continue}context.report({node:arg,messageId:"missingBoundsCheck",data:{filePath:filename,line:String(node.loc?.start.line??0)}})}}}},BinaryExpression(node){const leftText=sourceCode.getText(node.left);const rightText=sourceCode.getText(node.right);if(leftText.includes(".length")||rightText.includes(".length")){}}}}});