eslint-plugin-node-security 4.8.0 → 4.9.0

package/src/rules/no-ssrf/index.js

@@ -1,221 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noSsrf = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const HTTP_CLIENT_FUNCTIONS = new Set([
-    'fetch',
-    'got',
-    'nodeFetch',
-    'undici',
-]);
-const HTTP_CLIENT_METHODS = new Set([
-    'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'request',
-]);
-const HTTP_CLIENT_OBJECTS = new Set([
-    'axios', 'got', 'superagent', 'request', 'http', 'https', 'undici', 'needle',
-]);
-const VALIDATION_FUNCTION_NAMES = new Set([
-    'validateUrl', 'validateURL', 'isValidUrl', 'isSafeUrl', 'isAllowed',
-    'isValidURL', 'checkUrl', 'checkURL', 'sanitizeUrl', 'sanitizeURL',
-]);
-const USER_INPUT_SUBSTRINGS = [
-    'url', 'endpoint', 'uri', 'href', 'link',
-    'target', 'dest', 'source', 'host',
-    'user', 'input', 'param',
-];
-function isUserInputParamName(name) {
-    const lower = name.toLowerCase();
-    return USER_INPUT_SUBSTRINGS.some(sub => lower.includes(sub));
-}
-const REQUEST_ROOT_NAMES = new Set(['req', 'request', 'ctx', 'event']);
-const URL_OPTION_KEYS = new Set(['url', 'href', 'uri']);
-function isRequestSourced(node) {
-    let current = node;
-    while (current.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
-        current = current.object;
-    }
-    return (current !== node &&
-        current.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        REQUEST_ROOT_NAMES.has(current.name.toLowerCase()));
-}
-function carriesUntrustedUrl(node) {
-    switch (node.type) {
-        case eslint_devkit_1.AST_NODE_TYPES.Identifier:
-            return isUserInputParamName(node.name);
-        case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:
-            return isRequestSourced(node);
-        case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:
-            return node.expressions.some(carriesUntrustedUrl);
-        case eslint_devkit_1.AST_NODE_TYPES.CallExpression:
-        case eslint_devkit_1.AST_NODE_TYPES.NewExpression:
-            return node.arguments.some(carriesUntrustedUrl);
-        case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:
-            return carriesUntrustedUrl(node.left) || carriesUntrustedUrl(node.right);
-        case eslint_devkit_1.AST_NODE_TYPES.ObjectExpression:
-            return node.properties.some(property => {
-                if (property.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
-                    return false;
-                const value = property.value;
-                if (isRequestSourced(value))
-                    return true;
-                const key = property.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
-                    ? property.key.name
-                    : property.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal
-                        ? String(property.key.value)
-                        : '';
-                return URL_OPTION_KEYS.has(key.toLowerCase()) && carriesUntrustedUrl(value);
-            });
-        default:
-            return false;
-    }
-}
-function nodeContainsValidation(node) {
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
-        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        node.callee.name === 'URL') {
-        return true;
-    }
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        VALIDATION_FUNCTION_NAMES.has(node.callee.name)) {
-        return true;
-    }
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-        node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-        const method = node.callee.property.name;
-        if (method === 'includes' || method === 'has' || method === 'startsWith' || method === 'test' || method === 'some') {
-            return true;
-        }
-    }
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression &&
-        (node.operator === '===' || node.operator === '==') &&
-        ((node.left.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-            node.left.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-            (node.left.property.name === 'hostname' || node.left.property.name === 'host')) ||
-            (node.right.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.right.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                (node.right.property.name === 'hostname' || node.right.property.name === 'host')))) {
-        return true;
-    }
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement) {
-        return true;
-    }
-    const SKIP_KEYS = new Set(['parent', 'range', 'loc', 'tokens', 'comments', 'start', 'end']);
-    for (const key of Object.keys(node)) {
-        if (SKIP_KEYS.has(key))
-            continue;
-        const value = node[key];
-        if (value && typeof value === 'object' && 'type' in value) {
-            if (nodeContainsValidation(value))
-                return true;
-        }
-        if (Array.isArray(value)) {
-            for (const item of value) {
-                if (item && typeof item === 'object' && 'type' in item) {
-                    if (nodeContainsValidation(item))
-                        return true;
-                }
-            }
-        }
-    }
-    return false;
-}
-function hasValidationBefore(node) {
-    let current = node.parent;
-    while (current) {
-        const parent = current.parent;
-        if (!parent)
-            break;
-        if (parent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement || parent.type === eslint_devkit_1.AST_NODE_TYPES.Program) {
-            const body = parent.body;
-            const idx = body.indexOf(current);
-            for (let i = idx - 1; i >= 0 && i >= idx - 10; i--) {
-                if (nodeContainsValidation(body[i])) {
-                    return true;
-                }
-            }
-        }
-        if (parent.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement && parent.test) {
-            if (nodeContainsValidation(parent.test)) {
-                return true;
-            }
-        }
-        current = parent;
-    }
-    return false;
-}
-exports.noSsrf = (0, eslint_devkit_1.createRule)({
-    name: 'no-ssrf',
-    meta: {
-        type: 'suggestion',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md',
-            description: 'Flags HTTP calls whose URL argument is a user-input-named identifier or reads off a request object — a heuristic prompt for code review, not a proof of SSRF',
-            cwe: 'CWE-918',
-            cvss: 9.1,
-        },
-        messages: {
-            ssrfVulnerability: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Possible SSRF — heuristic (CWE-918)',
-                cwe: 'CWE-918',
-                description: 'HTTP call whose URL argument name suggests user input. This is a naming heuristic, not data-flow analysis — review whether the URL could originate from an untrusted source at runtime.',
-                severity: 'LOW',
-                fix: 'If the URL comes from user input, validate it against an allowlist of permitted hosts before making the request.',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: true,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [{ allowInTests: true }],
-    create(context, [options = {}]) {
-        const { allowInTests = true } = options || {};
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        if (isTestFile)
-            return {};
-        return {
-            CallExpression(node) {
-                let isHttpCall = false;
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    HTTP_CLIENT_FUNCTIONS.has(node.callee.name)) {
-                    isHttpCall = true;
-                }
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    node.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    HTTP_CLIENT_OBJECTS.has(node.callee.object.name) &&
-                    HTTP_CLIENT_METHODS.has(node.callee.property.name)) {
-                    isHttpCall = true;
-                }
-                if (!isHttpCall)
-                    return;
-                const urlArg = node.arguments[0];
-                if (!urlArg)
-                    return;
-                if (hasValidationBefore(node)) {
-                    return;
-                }
-                if (!carriesUntrustedUrl(urlArg)) {
-                    return;
-                }
-                context.report({
-                    node,
-                    messageId: 'ssrfVulnerability',
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noSsrf=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const HTTP_CLIENT_FUNCTIONS=new Set(["fetch","got","nodeFetch","undici"]);const HTTP_CLIENT_METHODS=new Set(["get","post","put","patch","delete","head","options","request"]);const HTTP_CLIENT_OBJECTS=new Set(["axios","got","superagent","request","http","https","undici","needle"]);const VALIDATION_FUNCTION_NAMES=new Set(["validateUrl","validateURL","isValidUrl","isSafeUrl","isAllowed","isValidURL","checkUrl","checkURL","sanitizeUrl","sanitizeURL"]);const USER_INPUT_SUBSTRINGS=["url","endpoint","uri","href","link","target","dest","source","host","user","input","param"];function isUserInputParamName(name){const lower=name.toLowerCase();return USER_INPUT_SUBSTRINGS.some(sub=>lower.includes(sub))}const REQUEST_ROOT_NAMES=new Set(["req","request","ctx","event"]);const URL_OPTION_KEYS=new Set(["url","href","uri"]);function isRequestSourced(node){let current=node;while(current.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression){current=current.object}return current!==node&&current.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&REQUEST_ROOT_NAMES.has(current.name.toLowerCase())}function carriesUntrustedUrl(node){switch(node.type){case eslint_devkit_1.AST_NODE_TYPES.Identifier:return isUserInputParamName(node.name);case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:return isRequestSourced(node);case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:return node.expressions.some(carriesUntrustedUrl);case eslint_devkit_1.AST_NODE_TYPES.CallExpression:case eslint_devkit_1.AST_NODE_TYPES.NewExpression:return node.arguments.some(carriesUntrustedUrl);case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:return carriesUntrustedUrl(node.left)||carriesUntrustedUrl(node.right);case eslint_devkit_1.AST_NODE_TYPES.ObjectExpression:return node.properties.some(property=>{if(property.type!==eslint_devkit_1.AST_NODE_TYPES.Property)return false;const value=property.value;if(isRequestSourced(value))return true;const key=property.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier?property.key.name:property.key.type===eslint_devkit_1.AST_NODE_TYPES.Literal?String(property.key.value):"";return URL_OPTION_KEYS.has(key.toLowerCase())&&carriesUntrustedUrl(value)});default:return false}}function nodeContainsValidation(node){if(node.type===eslint_devkit_1.AST_NODE_TYPES.NewExpression&&node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="URL"){return true}if(node.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&VALIDATION_FUNCTION_NAMES.has(node.callee.name)){return true}if(node.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){const method=node.callee.property.name;if(method==="includes"||method==="has"||method==="startsWith"||method==="test"||method==="some"){return true}}if(node.type===eslint_devkit_1.AST_NODE_TYPES.BinaryExpression&&(node.operator==="==="||node.operator==="==")&&(node.left.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.left.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.left.property.name==="hostname"||node.left.property.name==="host")||node.right.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.right.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.right.property.name==="hostname"||node.right.property.name==="host"))){return true}if(node.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement){return true}const SKIP_KEYS=new Set(["parent","range","loc","tokens","comments","start","end"]);for(const key of Object.keys(node)){if(SKIP_KEYS.has(key))continue;const value=node[key];if(value&&typeof value==="object"&&"type"in value){if(nodeContainsValidation(value))return true}if(Array.isArray(value)){for(const item of value){if(item&&typeof item==="object"&&"type"in item){if(nodeContainsValidation(item))return true}}}}return false}function hasValidationBefore(node){let current=node.parent;while(current){const parent=current.parent;if(!parent)break;if(parent.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement||parent.type===eslint_devkit_1.AST_NODE_TYPES.Program){const body=parent.body;const idx=body.indexOf(current);for(let i=idx-1;i>=0&&i>=idx-10;i--){if(nodeContainsValidation(body[i])){return true}}}if(parent.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement&&parent.test){if(nodeContainsValidation(parent.test)){return true}}current=parent}return false}exports.noSsrf=(0,eslint_devkit_1.createRule)({name:"no-ssrf",meta:{type:"suggestion",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ssrf.md",description:"Flags HTTP calls whose URL argument is a user-input-named identifier or reads off a request object \u2014 a heuristic prompt for code review, not a proof of SSRF",cwe:"CWE-918",cvss:9.1},messages:{ssrfVulnerability:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Possible SSRF \u2014 heuristic (CWE-918)",cwe:"CWE-918",description:"HTTP call whose URL argument name suggests user input. This is a naming heuristic, not data-flow analysis \u2014 review whether the URL could originate from an untrusted source at runtime.",severity:"LOW",fix:"If the URL comes from user input, validate it against an allowlist of permitted hosts before making the request.",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:true}},additionalProperties:false}]},defaultOptions:[{allowInTests:true}],create(context,[options={}]){const{allowInTests=true}=options||{};const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);if(isTestFile)return{};return{CallExpression(node){let isHttpCall=false;if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&HTTP_CLIENT_FUNCTIONS.has(node.callee.name)){isHttpCall=true}if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&HTTP_CLIENT_OBJECTS.has(node.callee.object.name)&&HTTP_CLIENT_METHODS.has(node.callee.property.name)){isHttpCall=true}if(!isHttpCall)return;const urlArg=node.arguments[0];if(!urlArg)return;if(hasValidationBefore(node)){return}if(!carriesUntrustedUrl(urlArg)){return}context.report({node,messageId:"ssrfVulnerability"})}}}});

package/src/rules/no-static-iv/index.js

@@ -1,129 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noStaticIv = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const STATIC_IV_PATTERNS = [
-    /^[0-9a-f]+$/i,
-    /^[A-Za-z0-9+/]+=*$/,
-];
-exports.noStaticIv = (0, eslint_devkit_1.createRule)({
-    name: 'no-static-iv',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-static-iv.md',
-            description: 'Disallow static or hardcoded initialization vectors (IVs)',
-            cwe: 'CWE-329',
-            cvss: 7.5,
-        },
-        hasSuggestions: false,
-        messages: {
-            staticIv: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Static IV detected',
-                cwe: 'CWE-329',
-                description: 'Hardcoded IV detected. Using static IVs makes encryption deterministic, allowing attackers to detect repeated plaintexts.',
-                severity: 'HIGH',
-                fix: 'Generate IV dynamically using crypto.randomBytes(16)',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#initialization-vectors',
-            }),
-            useRandomBytes: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use randomBytes',
-                description: 'Generate IV dynamically for each encryption operation',
-                severity: 'LOW',
-                fix: 'const iv = crypto.randomBytes(16);',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow static IVs in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        const randomIvVariables = new Set();
-        function checkVariableDeclarator(node) {
-            if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                node.init?.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                const init = node.init;
-                if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    init.callee.property.name === 'randomBytes') {
-                    randomIvVariables.add(node.id.name);
-                }
-                if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    init.callee.name === 'randomBytes') {
-                    randomIvVariables.add(node.id.name);
-                }
-            }
-        }
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            const isCipherivCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                (node.callee.property.name === 'createCipheriv' || node.callee.property.name === 'createDecipheriv')) ||
-                (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    (node.callee.name === 'createCipheriv' || node.callee.name === 'createDecipheriv'));
-            if (isCipherivCall && node.arguments.length >= 3) {
-                const ivArg = node.arguments[2];
-                checkIvArgument(ivArg);
-            }
-        }
-        function checkIvArgument(ivArg) {
-            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof ivArg.value === 'string') {
-                const value = ivArg.value;
-                if (STATIC_IV_PATTERNS.some(p => p.test(value)) || value.length >= 8) {
-                    reportStaticIv(ivArg);
-                }
-            }
-            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-                ivArg.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                ivArg.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                ivArg.callee.object.name === 'Buffer' &&
-                ivArg.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                (ivArg.callee.property.name === 'from' || ivArg.callee.property.name === 'alloc')) {
-                const firstArg = ivArg.arguments[0];
-                if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string') {
-                    reportStaticIv(ivArg);
-                }
-                if (firstArg?.type === eslint_devkit_1.AST_NODE_TYPES.ArrayExpression) {
-                    const allLiterals = firstArg.elements.every((el) => el?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof el.value === 'number');
-                    if (allLiterals) {
-                        reportStaticIv(ivArg);
-                    }
-                }
-            }
-            if (ivArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-            }
-        }
-        function reportStaticIv(node) {
-            context.report({
-                node,
-                messageId: 'staticIv',
-            });
-        }
-        return {
-            VariableDeclarator: checkVariableDeclarator,
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noStaticIv=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const STATIC_IV_PATTERNS=[/^[0-9a-f]+$/i,/^[A-Za-z0-9+/]+=*$/];exports.noStaticIv=(0,eslint_devkit_1.createRule)({name:"no-static-iv",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-static-iv.md",description:"Disallow static or hardcoded initialization vectors (IVs)",cwe:"CWE-329",cvss:7.5},hasSuggestions:false,messages:{staticIv:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Static IV detected",cwe:"CWE-329",description:"Hardcoded IV detected. Using static IVs makes encryption deterministic, allowing attackers to detect repeated plaintexts.",severity:"HIGH",fix:"Generate IV dynamically using crypto.randomBytes(16)",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#initialization-vectors"}),useRandomBytes:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use randomBytes",description:"Generate IV dynamically for each encryption operation",severity:"LOW",fix:"const iv = crypto.randomBytes(16);",documentationLink:"https://nodejs.org/api/crypto.html#cryptorandombytessize-callback"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow static IVs in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);const randomIvVariables=new Set;function checkVariableDeclarator(node){if(node.id.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.init?.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){const init=node.init;if(init.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&init.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&init.callee.property.name==="randomBytes"){randomIvVariables.add(node.id.name)}if(init.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&init.callee.name==="randomBytes"){randomIvVariables.add(node.id.name)}}}function checkCallExpression(node){if(isTestFile)return;const isCipherivCall=node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.callee.property.name==="createCipheriv"||node.callee.property.name==="createDecipheriv")||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.callee.name==="createCipheriv"||node.callee.name==="createDecipheriv");if(isCipherivCall&&node.arguments.length>=3){const ivArg=node.arguments[2];checkIvArgument(ivArg)}}function checkIvArgument(ivArg){if(ivArg.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof ivArg.value==="string"){const value=ivArg.value;if(STATIC_IV_PATTERNS.some(p=>p.test(value))||value.length>=8){reportStaticIv(ivArg)}}if(ivArg.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&ivArg.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&ivArg.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&ivArg.callee.object.name==="Buffer"&&ivArg.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(ivArg.callee.property.name==="from"||ivArg.callee.property.name==="alloc")){const firstArg=ivArg.arguments[0];if(firstArg?.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof firstArg.value==="string"){reportStaticIv(ivArg)}if(firstArg?.type===eslint_devkit_1.AST_NODE_TYPES.ArrayExpression){const allLiterals=firstArg.elements.every(el=>el?.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof el.value==="number");if(allLiterals){reportStaticIv(ivArg)}}}if(ivArg.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){}}function reportStaticIv(node){context.report({node,messageId:"staticIv"})}return{VariableDeclarator:checkVariableDeclarator,CallExpression:checkCallExpression}}});

package/src/rules/no-timing-unsafe-compare/index.js

@@ -1,106 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noTimingUnsafeCompare = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const DEFAULT_SECRET_PATTERNS = [
-    'token', 'secret', 'key', 'password', 'hash', 'signature',
-    'mac', 'hmac', 'digest', 'apiKey', 'api_key', 'api-key',
-    'auth', 'credential', 'bearer', 'jwt', 'csrf', 'nonce',
-    'ssn', 'social_security', 'social-security',
-    'pii', 'private_key', 'private-key', 'privateKey',
-    'access_token', 'access-token', 'accessToken',
-    'refresh_token', 'refresh-token', 'refreshToken',
-    'session_id', 'session-id', 'sessionId',
-    'auth_token', 'auth-token', 'authToken',
-    'encryption_key', 'encryption-key', 'encryptionKey',
-];
-exports.noTimingUnsafeCompare = (0, eslint_devkit_1.createRule)({
-    name: 'no-timing-unsafe-compare',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-timing-unsafe-compare.md',
-            description: 'Disallow timing-unsafe comparison of secrets',
-            cwe: 'CWE-208',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            timingUnsafeCompare: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Timing-unsafe comparison',
-                cwe: 'CWE-208',
-                description: 'Using === to compare secrets enables timing attacks. The comparison short-circuits on first mismatch, leaking information about the secret.',
-                severity: 'HIGH',
-                fix: 'Use crypto.timingSafeEqual() for constant-time comparison',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b',
-            }),
-            useTimingSafeEqual: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use timingSafeEqual',
-                description: 'Use constant-time comparison to prevent timing attacks',
-                severity: 'LOW',
-                fix: 'crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    secretPatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: DEFAULT_SECRET_PATTERNS,
-                        description: 'Variable name patterns that indicate secrets',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            secretPatterns: DEFAULT_SECRET_PATTERNS,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { secretPatterns = DEFAULT_SECRET_PATTERNS } = options;
-        const patterns = secretPatterns.map(p => new RegExp(p, 'i'));
-        function isSecretIdentifier(node) {
-            if (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                return patterns.some(p => p.test(node.name));
-            }
-            if (node.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
-                const prop = node.property;
-                if (prop.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    return patterns.some(p => p.test(prop.name));
-                }
-            }
-            return false;
-        }
-        function checkBinaryExpression(node) {
-            if (node.operator !== '===' && node.operator !== '==' &&
-                node.operator !== '!==' && node.operator !== '!=') {
-                return;
-            }
-            const leftIsSecret = isSecretIdentifier(node.left);
-            const rightIsSecret = isSecretIdentifier(node.right);
-            if (leftIsSecret || rightIsSecret) {
-                context.report({
-                    node,
-                    messageId: 'timingUnsafeCompare',
-                    suggest: [
-                        {
-                            messageId: 'useTimingSafeEqual',
-                            fix: () => null,
-                        },
-                    ],
-                });
-            }
-        }
-        return {
-            BinaryExpression: checkBinaryExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noTimingUnsafeCompare=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const DEFAULT_SECRET_PATTERNS=["token","secret","password","hash","signature","mac","hmac","digest","apiKey","api_key","api-key","auth","credential","bearer","jwt","csrf","nonce","ssn","social_security","social-security","pii","private_key","private-key","privateKey","access_token","access-token","accessToken","refresh_token","refresh-token","refreshToken","session_id","session-id","sessionId","auth_token","auth-token","authToken","encryption_key","encryption-key","encryptionKey"];function isExistenceCheck(node){if(node.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.name==="undefined")return true;if(node.type===eslint_devkit_1.AST_NODE_TYPES.Literal){return node.value===null||typeof node.value==="number"||typeof node.value==="boolean"}return false}exports.noTimingUnsafeCompare=(0,eslint_devkit_1.createRule)({name:"no-timing-unsafe-compare",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-timing-unsafe-compare.md",description:"Disallow timing-unsafe comparison of secrets",cwe:"CWE-208",cvss:7.5},hasSuggestions:true,messages:{timingUnsafeCompare:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Timing-unsafe comparison",cwe:"CWE-208",description:"Using === to compare secrets enables timing attacks. The comparison short-circuits on first mismatch, leaking information about the secret.",severity:"HIGH",fix:"Use crypto.timingSafeEqual() for constant-time comparison",documentationLink:"https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b"}),useTimingSafeEqual:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use timingSafeEqual",description:"Use constant-time comparison to prevent timing attacks",severity:"LOW",fix:"crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))",documentationLink:"https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b"})},schema:[{type:"object",properties:{secretPatterns:{type:"array",items:{type:"string"},default:DEFAULT_SECRET_PATTERNS,description:"Variable name patterns that indicate secrets"}},additionalProperties:false}]},defaultOptions:[{secretPatterns:DEFAULT_SECRET_PATTERNS}],create(context,[options={}]){const{secretPatterns=DEFAULT_SECRET_PATTERNS}=options;const patterns=secretPatterns.map(p=>new RegExp(p,"i"));function isSecretIdentifier(node){if(node.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){return patterns.some(p=>p.test(node.name))}if(node.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression){const prop=node.property;if(prop.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){return patterns.some(p=>p.test(prop.name))}}return false}function checkBinaryExpression(node){if(node.operator!=="==="&&node.operator!=="=="&&node.operator!=="!=="&&node.operator!=="!="){return}if(isExistenceCheck(node.left)||isExistenceCheck(node.right)){return}const leftIsSecret=isSecretIdentifier(node.left);const rightIsSecret=isSecretIdentifier(node.right);if(leftIsSecret||rightIsSecret){context.report({node,messageId:"timingUnsafeCompare",suggest:[{messageId:"useTimingSafeEqual",fix:()=>null}]})}}return{BinaryExpression:checkBinaryExpression}}});