eslint-plugin-node-security 4.8.0 → 4.9.0

package/src/rules/detect-non-literal-fs-filename/index.js

@@ -1,516 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectNonLiteralFsFilename = exports.determineRiskLevel = exports.isFsModule = exports.generateRefactoringSteps = void 0;
-exports.fsMethodName = fsMethodName;
-exports.isFsRequire = isFsRequire;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const FS_OPERATIONS = [
-    {
-        method: 'readFile',
-        dangerous: true,
-        vulnerability: 'file-access',
-        safePattern: 'path.resolve(SAFE_DIR, path.basename(userInput))',
-        example: {
-            bad: 'fs.readFile(userPath, callback)',
-            good: 'const safePath = path.join(SAFE_UPLOADS_DIR, path.basename(userPath)); fs.readFile(safePath, callback)'
-        },
-        effort: '10-15 minutes'
-    },
-    {
-        method: 'writeFile',
-        dangerous: true,
-        vulnerability: 'file-access',
-        safePattern: 'path.resolve(SAFE_DIR, path.basename(userInput))',
-        example: {
-            bad: 'fs.writeFile(userPath, data, callback)',
-            good: 'const safePath = path.join(SAFE_WRITES_DIR, path.basename(userPath)); fs.writeFile(safePath, data, callback)'
-        },
-        effort: '10-15 minutes'
-    },
-    {
-        method: 'stat',
-        dangerous: true,
-        vulnerability: 'path-traversal',
-        safePattern: 'path.resolve(baseDir, userInput) with validation',
-        example: {
-            bad: 'fs.stat(userPath, callback)',
-            good: 'const resolvedPath = path.resolve(SAFE_DIR, userPath);\nif (!resolvedPath.startsWith(SAFE_DIR)) return;\nfs.stat(resolvedPath, callback)'
-        },
-        effort: '15-20 minutes'
-    },
-    {
-        method: 'readdir',
-        dangerous: true,
-        vulnerability: 'directory-traversal',
-        safePattern: 'Validate directory is within allowed paths',
-        example: {
-            bad: 'fs.readdir(userDir, callback)',
-            good: 'const resolvedDir = path.resolve(ALLOWED_DIRS, userDir);\nif (!resolvedDir.startsWith(ALLOWED_DIRS)) return;\nfs.readdir(resolvedDir, callback)'
-        },
-        effort: '15-20 minutes'
-    }
-];
-const hasTraversalPatterns = (pathStr) => {
-    return /\.\.[/\\]/.test(pathStr) || /^\.\.[/\\]/.test(pathStr);
-};
-const generateRefactoringSteps = (operation) => {
-    switch (operation.method) {
-        case 'readFile':
-        case 'writeFile':
-            return [
-                '   1. Define a SAFE_DIR constant for allowed operations',
-                '   2. Use path.basename() to strip directory components',
-                '   3. Combine with SAFE_DIR: path.join(SAFE_DIR, path.basename(userPath))',
-                '   4. Optionally validate file extensions',
-                '   5. Add error handling for invalid paths'
-            ].join('\n');
-        case 'stat':
-            return [
-                '   1. Use path.resolve() to normalize the path',
-                '   2. Check if resolved path starts with allowed base directory',
-                '   3. Reject requests that escape the allowed directory',
-                '   4. Use path.relative() for additional validation',
-                '   5. Log security events for monitoring'
-            ].join('\n');
-        case 'readdir':
-            return [
-                '   1. Resolve the directory path: path.resolve(ALLOWED_DIRS, userDir)',
-                '   2. Validate resolved path starts with ALLOWED_DIRS',
-                '   3. Check directory exists and is readable',
-                '   4. Consider whitelisting allowed directories',
-                '   5. Add rate limiting to prevent enumeration attacks'
-            ].join('\n');
-        default:
-            return [
-                '   1. Identify the specific file operation needed',
-                '   2. Define safe base directories for operations',
-                '   3. Use path.resolve() and validate containment',
-                '   4. Sanitize user input (basename, extension validation)',
-                '   5. Add comprehensive error handling'
-            ].join('\n');
-    }
-};
-exports.generateRefactoringSteps = generateRefactoringSteps;
-const FS_MODULES = new Set(['fs', 'node:fs', 'fs/promises', 'node:fs/promises']);
-const isFsModule = (source) => typeof source === 'string' && FS_MODULES.has(source);
-exports.isFsModule = isFsModule;
-function fsMethodName(callee, namespaces, named) {
-    if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
-        return named.get(callee.name);
-    if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
-        callee.computed ||
-        callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-        return undefined;
-    }
-    const object = callee.object;
-    if (object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && namespaces.has(object.name)) {
-        return callee.property.name;
-    }
-    if (object.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-        !object.computed &&
-        object.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        namespaces.has(object.object.name) &&
-        object.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        object.property.name === 'promises') {
-        return callee.property.name;
-    }
-    return undefined;
-}
-function isFsRequire(node) {
-    return (node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
-        node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        node.callee.name === 'require' &&
-        node.arguments.length > 0 &&
-        node.arguments[0].type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
-        (0, exports.isFsModule)(node.arguments[0].value));
-}
-const determineRiskLevel = (operation, pathStr) => {
-    if (hasTraversalPatterns(pathStr)) {
-        return 'CRITICAL';
-    }
-    if (operation.dangerous) {
-        return 'HIGH';
-    }
-    return 'MEDIUM';
-};
-exports.determineRiskLevel = determineRiskLevel;
-exports.detectNonLiteralFsFilename = (0, eslint_devkit_2.createRule)({
-    name: 'detect-non-literal-fs-filename',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-non-literal-fs-filename.md',
-            description: 'Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system',
-            cwe: 'CWE-22',
-            confidence: 'medium',
-        },
-        messages: {
-            fsPathTraversal: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: '🔑',
-                issueName: 'Path traversal',
-                cwe: 'CWE-22',
-                description: 'Path traversal vulnerability',
-                severity: '{{riskLevel}}',
-                fix: '{{safePattern}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Path_Traversal',
-            }),
-            usePathResolve: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use path.resolve',
-                description: 'Use path.resolve() to normalize paths',
-                severity: 'LOW',
-                fix: 'path.resolve(SAFE_DIR, userInput)',
-                documentationLink: 'https://nodejs.org/api/path.html#pathresolvepaths',
-            }),
-            validatePath: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Validate Path',
-                description: 'Validate resolved path starts with allowed base',
-                severity: 'LOW',
-                fix: 'if (!resolved.startsWith(SAFE_DIR)) throw new Error()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Path_Traversal',
-            }),
-            useBasename: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use path.basename',
-                description: 'Use path.basename() to strip directory components',
-                severity: 'LOW',
-                fix: 'path.basename(userInput)',
-                documentationLink: 'https://nodejs.org/api/path.html#pathbasenamepath-suffix',
-            }),
-            createSafeDir: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Define Safe Directory',
-                description: 'Define SAFE_DIR constant',
-                severity: 'LOW',
-                fix: 'const SAFE_DIR = path.resolve(__dirname, "uploads")',
-                documentationLink: 'https://owasp.org/www-community/attacks/Path_Traversal',
-            }),
-            whitelistExtensions: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Whitelist Extensions',
-                description: 'Whitelist allowed file extensions',
-                severity: 'LOW',
-                fix: 'const ALLOWED_EXT = [".txt", ".pdf"]; if (!ALLOWED_EXT.includes(ext)) throw',
-                documentationLink: 'https://owasp.org/www-community/attacks/Path_Traversal',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowLiterals: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow literal string paths'
-                    },
-                    additionalMethods: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional fs methods to check'
-                    },
-                    allowedExtensions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Allowed file extensions (e.g., [".txt", ".json"])'
-                    }
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowLiterals: false,
-            additionalMethods: []
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { allowLiterals = false, additionalMethods = [] } = options;
-        const dangerousMethods = new Set([
-            'readFile', 'readFileSync',
-            'writeFile', 'writeFileSync',
-            'appendFile', 'appendFileSync',
-            'stat', 'statSync',
-            'lstat', 'lstatSync',
-            'readdir', 'readdirSync',
-            'unlink', 'unlinkSync',
-            'mkdir', 'mkdirSync',
-            'rmdir', 'rmdirSync',
-            'access', 'accessSync',
-            'createReadStream', 'createWriteStream',
-            ...additionalMethods
-        ]);
-        const isLiteralString = (node) => {
-            return node.type === 'Literal' && typeof node.value === 'string';
-        };
-        const extractPathArgument = (node, method) => {
-            const operation = FS_OPERATIONS.find(op => op.method === method) || null;
-            const pathNode = node.arguments.length > 0 ? node.arguments[0] : null;
-            const sourceCode = context.sourceCode;
-            const path = pathNode ? sourceCode.getText(pathNode) : '';
-            return { path, pathNode, operation };
-        };
-        const isDangerousPath = (pathNode, pathStr) => {
-            if (allowLiterals && pathNode && isLiteralString(pathNode)) {
-                return false;
-            }
-            if (pathNode && isLiteralString(pathNode) && hasTraversalPatterns(pathStr)) {
-                return true;
-            }
-            if (pathNode && isSafePathConstruction(pathNode)) {
-                return false;
-            }
-            if (pathNode && hasPathValidation(pathNode)) {
-                return false;
-            }
-            if (pathNode && pathNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                const callee = pathNode.callee;
-                if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    callee.object.name === 'path' &&
-                    callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    ['join', 'resolve'].includes(callee.property.name)) {
-                    const dynamicArgs = pathNode.arguments.filter((arg) => arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name !== '__dirname');
-                    if (dynamicArgs.length > 0 && dynamicArgs.every((arg) => hasPathValidation(arg))) {
-                        return false;
-                    }
-                }
-            }
-            return !pathNode || !isLiteralString(pathNode);
-        };
-        const isSafePathConstruction = (pathNode) => {
-            if (pathNode.type !== eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                return false;
-            }
-            const callee = pathNode.callee;
-            if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
-                callee.object.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier ||
-                callee.object.name !== 'path' ||
-                callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                return false;
-            }
-            const method = callee.property.name;
-            if (!['join', 'resolve'].includes(method)) {
-                return false;
-            }
-            const args = pathNode.arguments;
-            if (args.length === 0) {
-                return false;
-            }
-            const firstArg = args[0];
-            const isFirstArgSafe = (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && firstArg.name === '__dirname') ||
-                (firstArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof firstArg.value === 'string');
-            if (!isFirstArgSafe) {
-                return false;
-            }
-            for (let i = 1; i < args.length; i++) {
-                const arg = args[i];
-                if (arg.type !== eslint_devkit_1.AST_NODE_TYPES.Literal || typeof arg.value !== 'string') {
-                    return false;
-                }
-                if (hasTraversalPatterns(String(arg.value))) {
-                    return false;
-                }
-            }
-            return true;
-        };
-        const hasPathValidation = (pathNode) => {
-            if (pathNode.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                return false;
-            }
-            const varName = pathNode.name;
-            const isValidationCall = (testNode) => {
-                if (testNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
-                    testNode.operator === '!' &&
-                    testNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                    testNode = testNode.argument;
-                }
-                if (testNode.type !== eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
-                    return false;
-                }
-                if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    testNode.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    testNode.callee.object.name === varName &&
-                    testNode.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    (testNode.callee.property.name === 'startsWith' ||
-                        testNode.callee.property.name === 'includes')) {
-                    return true;
-                }
-                if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    testNode.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    testNode.callee.property.name === 'includes') {
-                    for (const arg of testNode.arguments) {
-                        if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name === varName) {
-                            return true;
-                        }
-                    }
-                }
-                if (testNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                    testNode.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    testNode.callee.property.name === 'test') {
-                    for (const arg of testNode.arguments) {
-                        if (arg.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && arg.name === varName) {
-                            return true;
-                        }
-                    }
-                }
-                return false;
-            };
-            const hasEarlyExit = (consequent) => {
-                if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
-                    return consequent.body.some(stmt => stmt.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement ||
-                        stmt.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement);
-                }
-                return consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement ||
-                    consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement;
-            };
-            let current = pathNode.parent;
-            let foundFunctionBody = false;
-            while (current && !foundFunctionBody) {
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                    if (isValidationCall(current.test)) {
-                        return true;
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement && current.parent && (current.parent.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
-                    current.parent.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
-                    current.parent.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression)) {
-                    foundFunctionBody = true;
-                    const blockBody = current.body;
-                    const nodeIndex = blockBody.findIndex((stmt) => {
-                        let check = pathNode;
-                        while (check) {
-                            if (check === stmt)
-                                return true;
-                            check = check.parent;
-                        }
-                        return false;
-                    });
-                    for (let i = 0; i < nodeIndex; i++) {
-                        const stmt = blockBody[i];
-                        if (stmt.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement &&
-                            isValidationCall(stmt.test) &&
-                            hasEarlyExit(stmt.consequent)) {
-                            return true;
-                        }
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        };
-        const fsNamespaces = new Set(['fs']);
-        const fsNamedMethods = new Map();
-        const pendingCalls = [];
-        function bindFsName(local, imported) {
-            if (imported === 'promises')
-                fsNamespaces.add(local);
-            else
-                fsNamedMethods.set(local, imported);
-        }
-        const checkFsCall = (node) => {
-            const methodName = fsMethodName(node.callee, fsNamespaces, fsNamedMethods);
-            if (methodName === undefined) {
-                return;
-            }
-            if (!dangerousMethods.has(methodName)) {
-                return;
-            }
-            const { path, pathNode, operation } = extractPathArgument(node, methodName);
-            const method = methodName;
-            if (!isDangerousPath(pathNode, path)) {
-                return;
-            }
-            const riskLevel = (0, exports.determineRiskLevel)(operation || FS_OPERATIONS[0], path);
-            const steps = operation ? (0, exports.generateRefactoringSteps)(operation) : 'Review file system access patterns';
-            const safePattern = operation?.safePattern || 'Use path.resolve() with validation';
-            context.report({
-                node,
-                messageId: 'fsPathTraversal',
-                data: {
-                    method,
-                    path,
-                    riskLevel,
-                    vulnerability: operation?.vulnerability || 'path traversal',
-                    safePattern,
-                    steps,
-                    effort: operation?.effort || '15-20 minutes'
-                },
-                suggest: [
-                    {
-                        messageId: 'usePathResolve',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'validatePath',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'useBasename',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'createSafeDir',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'whitelistExtensions',
-                        fix: () => null
-                    }
-                ]
-            });
-        };
-        return {
-            ImportDeclaration(node) {
-                if (!(0, exports.isFsModule)(node.source.value))
-                    return;
-                for (const spec of node.specifiers) {
-                    if (spec.type === eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier) {
-                        const imported = spec.imported.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
-                            ? spec.imported.name
-                            : spec.imported.value;
-                        bindFsName(spec.local.name, imported);
-                        continue;
-                    }
-                    fsNamespaces.add(spec.local.name);
-                }
-            },
-            VariableDeclarator(node) {
-                if (node.init === null || !isFsRequire(node.init))
-                    return;
-                if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                    fsNamespaces.add(node.id.name);
-                    return;
-                }
-                if (node.id.type !== eslint_devkit_1.AST_NODE_TYPES.ObjectPattern)
-                    return;
-                for (const prop of node.id.properties) {
-                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property || prop.computed)
-                        continue;
-                    if (prop.value.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
-                        continue;
-                    const key = prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier
-                        ? prop.key.name
-                        : prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof prop.key.value === 'string'
-                            ? prop.key.value
-                            : undefined;
-                    if (key === undefined)
-                        continue;
-                    bindFsName(prop.value.name, key);
-                }
-            },
-            CallExpression(node) {
-                pendingCalls.push(node);
-            },
-            'Program:exit'() {
-                for (const call of pendingCalls)
-                    checkFsCall(call);
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.detectNonLiteralFsFilename=exports.determineRiskLevel=exports.isFsModule=exports.generateRefactoringSteps=void 0;exports.fsMethodName=fsMethodName;exports.isFsRequire=isFsRequire;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const FS_OPERATIONS=[{method:"readFile",dangerous:true,vulnerability:"file-access",safePattern:"path.resolve(SAFE_DIR, path.basename(userInput))",example:{bad:"fs.readFile(userPath, callback)",good:"const safePath = path.join(SAFE_UPLOADS_DIR, path.basename(userPath)); fs.readFile(safePath, callback)"},effort:"10-15 minutes"},{method:"writeFile",dangerous:true,vulnerability:"file-access",safePattern:"path.resolve(SAFE_DIR, path.basename(userInput))",example:{bad:"fs.writeFile(userPath, data, callback)",good:"const safePath = path.join(SAFE_WRITES_DIR, path.basename(userPath)); fs.writeFile(safePath, data, callback)"},effort:"10-15 minutes"},{method:"stat",dangerous:true,vulnerability:"path-traversal",safePattern:"path.resolve(baseDir, userInput) with validation",example:{bad:"fs.stat(userPath, callback)",good:"const resolvedPath = path.resolve(SAFE_DIR, userPath);\nif (!resolvedPath.startsWith(SAFE_DIR)) return;\nfs.stat(resolvedPath, callback)"},effort:"15-20 minutes"},{method:"readdir",dangerous:true,vulnerability:"directory-traversal",safePattern:"Validate directory is within allowed paths",example:{bad:"fs.readdir(userDir, callback)",good:"const resolvedDir = path.resolve(ALLOWED_DIRS, userDir);\nif (!resolvedDir.startsWith(ALLOWED_DIRS)) return;\nfs.readdir(resolvedDir, callback)"},effort:"15-20 minutes"}];const hasTraversalPatterns=pathStr=>{return/\.\.[/\\]/.test(pathStr)||/^\.\.[/\\]/.test(pathStr)};const generateRefactoringSteps=operation=>{switch(operation.method){case"readFile":case"writeFile":return["   1. Define a SAFE_DIR constant for allowed operations","   2. Use path.basename() to strip directory components","   3. Combine with SAFE_DIR: path.join(SAFE_DIR, path.basename(userPath))","   4. Optionally validate file extensions","   5. Add error handling for invalid paths"].join("\n");case"stat":return["   1. Use path.resolve() to normalize the path","   2. Check if resolved path starts with allowed base directory","   3. Reject requests that escape the allowed directory","   4. Use path.relative() for additional validation","   5. Log security events for monitoring"].join("\n");case"readdir":return["   1. Resolve the directory path: path.resolve(ALLOWED_DIRS, userDir)","   2. Validate resolved path starts with ALLOWED_DIRS","   3. Check directory exists and is readable","   4. Consider whitelisting allowed directories","   5. Add rate limiting to prevent enumeration attacks"].join("\n");default:return["   1. Identify the specific file operation needed","   2. Define safe base directories for operations","   3. Use path.resolve() and validate containment","   4. Sanitize user input (basename, extension validation)","   5. Add comprehensive error handling"].join("\n")}};exports.generateRefactoringSteps=generateRefactoringSteps;const FS_MODULES=new Set(["fs","node:fs","fs/promises","node:fs/promises"]);const isFsModule=source=>typeof source==="string"&&FS_MODULES.has(source);exports.isFsModule=isFsModule;function fsMethodName(callee,namespaces,named){if(callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier)return named.get(callee.name);if(callee.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression||callee.computed||callee.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier){return void 0}const object=callee.object;if(object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&namespaces.has(object.name)){return callee.property.name}if(object.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&!object.computed&&object.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&namespaces.has(object.object.name)&&object.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&object.property.name==="promises"){return callee.property.name}return void 0}function isFsRequire(node){return node.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression&&node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="require"&&node.arguments.length>0&&node.arguments[0].type===eslint_devkit_1.AST_NODE_TYPES.Literal&&(0,exports.isFsModule)(node.arguments[0].value)}const determineRiskLevel=(operation,pathStr)=>{if(hasTraversalPatterns(pathStr)){return"CRITICAL"}if(operation.dangerous){return"HIGH"}return"MEDIUM"};exports.determineRiskLevel=determineRiskLevel;exports.detectNonLiteralFsFilename=(0,eslint_devkit_2.createRule)({name:"detect-non-literal-fs-filename",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-non-literal-fs-filename.md",description:"Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system",cwe:"CWE-22",confidence:"medium"},hasSuggestions:true,messages:{fsPathTraversal:(0,eslint_devkit_1.formatLLMMessage)({icon:"\u{1F511}",issueName:"Path traversal",cwe:"CWE-22",description:"Path traversal vulnerability",severity:"{{riskLevel}}",fix:"{{safePattern}}",documentationLink:"https://owasp.org/www-community/attacks/Path_Traversal"}),usePathResolve:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use path.resolve",description:"Use path.resolve() to normalize paths",severity:"LOW",fix:"path.resolve(SAFE_DIR, userInput)",documentationLink:"https://nodejs.org/api/path.html#pathresolvepaths"}),validatePath:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Validate Path",description:"Validate resolved path starts with allowed base",severity:"LOW",fix:"if (!resolved.startsWith(SAFE_DIR)) throw new Error()",documentationLink:"https://owasp.org/www-community/attacks/Path_Traversal"}),useBasename:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use path.basename",description:"Use path.basename() to strip directory components",severity:"LOW",fix:"path.basename(userInput)",documentationLink:"https://nodejs.org/api/path.html#pathbasenamepath-suffix"}),createSafeDir:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Define Safe Directory",description:"Define SAFE_DIR constant",severity:"LOW",fix:'const SAFE_DIR = path.resolve(__dirname, "uploads")',documentationLink:"https://owasp.org/www-community/attacks/Path_Traversal"}),whitelistExtensions:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Whitelist Extensions",description:"Whitelist allowed file extensions",severity:"LOW",fix:'const ALLOWED_EXT = [".txt", ".pdf"]; if (!ALLOWED_EXT.includes(ext)) throw',documentationLink:"https://owasp.org/www-community/attacks/Path_Traversal"})},schema:[{type:"object",properties:{allowLiterals:{type:"boolean",default:false,description:"Allow literal string paths"},additionalMethods:{type:"array",items:{type:"string"},default:[],description:"Additional fs methods to check"},allowedExtensions:{type:"array",items:{type:"string"},default:[],description:'Allowed file extensions (e.g., [".txt", ".json"])'}},additionalProperties:false}]},defaultOptions:[{allowLiterals:false,additionalMethods:[]}],create(context){const options=context.options[0]||{};const{allowLiterals=false,additionalMethods=[]}=options;const dangerousMethods=new Set(["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","stat","statSync","lstat","lstatSync","readdir","readdirSync","unlink","unlinkSync","mkdir","mkdirSync","rmdir","rmdirSync","access","accessSync","createReadStream","createWriteStream",...additionalMethods]);const isLiteralString=node=>{return node.type==="Literal"&&typeof node.value==="string"};const extractPathArgument=(node,method)=>{const operation=FS_OPERATIONS.find(op=>op.method===method)||null;const pathNode=node.arguments.length>0?node.arguments[0]:null;const sourceCode=context.sourceCode;const path=pathNode?sourceCode.getText(pathNode):"";return{path,pathNode,operation}};const isDangerousPath=(pathNode,pathStr)=>{if(allowLiterals&&pathNode&&isLiteralString(pathNode)){return false}if(pathNode&&isLiteralString(pathNode)&&hasTraversalPatterns(pathStr)){return true}if(pathNode&&isSafePathConstruction(pathNode)){return false}if(pathNode&&hasPathValidation(pathNode)){return false}if(pathNode&&pathNode.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){const callee=pathNode.callee;if(callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&callee.object.name==="path"&&callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&["join","resolve"].includes(callee.property.name)){const dynamicArgs=pathNode.arguments.filter(arg=>arg.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&arg.name!=="__dirname");if(dynamicArgs.length>0&&dynamicArgs.every(arg=>hasPathValidation(arg))){return false}}}return!pathNode||!isLiteralString(pathNode)};const isSafePathConstruction=pathNode=>{if(pathNode.type!==eslint_devkit_1.AST_NODE_TYPES.CallExpression){return false}const callee=pathNode.callee;if(callee.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression||callee.object.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier||callee.object.name!=="path"||callee.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier){return false}const method=callee.property.name;if(!["join","resolve"].includes(method)){return false}const args=pathNode.arguments;if(args.length===0){return false}const firstArg=args[0];const isFirstArgSafe=firstArg.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&firstArg.name==="__dirname"||firstArg.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof firstArg.value==="string";if(!isFirstArgSafe){return false}for(let i=1;i<args.length;i++){const arg=args[i];if(arg.type!==eslint_devkit_1.AST_NODE_TYPES.Literal||typeof arg.value!=="string"){return false}if(hasTraversalPatterns(String(arg.value))){return false}}return true};const hasPathValidation=pathNode=>{if(pathNode.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier){return false}const varName=pathNode.name;const isValidationCall=testNode=>{if(testNode.type===eslint_devkit_1.AST_NODE_TYPES.UnaryExpression&&testNode.operator==="!"&&testNode.argument.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression){testNode=testNode.argument}if(testNode.type!==eslint_devkit_1.AST_NODE_TYPES.CallExpression){return false}if(testNode.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&testNode.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&testNode.callee.object.name===varName&&testNode.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(testNode.callee.property.name==="startsWith"||testNode.callee.property.name==="includes")){return true}if(testNode.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&testNode.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&testNode.callee.property.name==="includes"){for(const arg of testNode.arguments){if(arg.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&arg.name===varName){return true}}}if(testNode.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&testNode.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&testNode.callee.property.name==="test"){for(const arg of testNode.arguments){if(arg.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&arg.name===varName){return true}}}return false};const hasEarlyExit=consequent=>{if(consequent.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement){return consequent.body.some(stmt=>stmt.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement||stmt.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement)}return consequent.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement||consequent.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement};let current=pathNode.parent;let foundFunctionBody=false;while(current&&!foundFunctionBody){if(current.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement){if(isValidationCall(current.test)){return true}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement&&current.parent&&(current.parent.type===eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration||current.parent.type===eslint_devkit_1.AST_NODE_TYPES.FunctionExpression||current.parent.type===eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression)){foundFunctionBody=true;const blockBody=current.body;const nodeIndex=blockBody.findIndex(stmt=>{let check=pathNode;while(check){if(check===stmt)return true;check=check.parent}return false});for(let i=0;i<nodeIndex;i++){const stmt=blockBody[i];if(stmt.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement&&isValidationCall(stmt.test)&&hasEarlyExit(stmt.consequent)){return true}}}current=current.parent}return false};const fsNamespaces=new Set(["fs"]);const fsNamedMethods=new Map;const pendingCalls=[];function bindFsName(local,imported){if(imported==="promises")fsNamespaces.add(local);else fsNamedMethods.set(local,imported)}const checkFsCall=node=>{const methodName=fsMethodName(node.callee,fsNamespaces,fsNamedMethods);if(methodName===void 0){return}if(!dangerousMethods.has(methodName)){return}const{path,pathNode,operation}=extractPathArgument(node,methodName);const method=methodName;if(!isDangerousPath(pathNode,path)){return}const riskLevel=(0,exports.determineRiskLevel)(operation||FS_OPERATIONS[0],path);const steps=operation?(0,exports.generateRefactoringSteps)(operation):"Review file system access patterns";const safePattern=operation?.safePattern||"Use path.resolve() with validation";context.report({node,messageId:"fsPathTraversal",data:{method,path,riskLevel,vulnerability:operation?.vulnerability||"path traversal",safePattern,steps,effort:operation?.effort||"15-20 minutes"},suggest:[{messageId:"usePathResolve",fix:()=>null},{messageId:"validatePath",fix:()=>null},{messageId:"useBasename",fix:()=>null},{messageId:"createSafeDir",fix:()=>null},{messageId:"whitelistExtensions",fix:()=>null}]})};return{ImportDeclaration(node){if(!(0,exports.isFsModule)(node.source.value))return;for(const spec of node.specifiers){if(spec.type===eslint_devkit_1.AST_NODE_TYPES.ImportSpecifier){const imported=spec.imported.type===eslint_devkit_1.AST_NODE_TYPES.Identifier?spec.imported.name:spec.imported.value;bindFsName(spec.local.name,imported);continue}fsNamespaces.add(spec.local.name)}},VariableDeclarator(node){if(node.init===null||!isFsRequire(node.init))return;if(node.id.type===eslint_devkit_1.AST_NODE_TYPES.Identifier){fsNamespaces.add(node.id.name);return}if(node.id.type!==eslint_devkit_1.AST_NODE_TYPES.ObjectPattern)return;for(const prop of node.id.properties){if(prop.type!==eslint_devkit_1.AST_NODE_TYPES.Property||prop.computed)continue;if(prop.value.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)continue;const key=prop.key.type===eslint_devkit_1.AST_NODE_TYPES.Identifier?prop.key.name:prop.key.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof prop.key.value==="string"?prop.key.value:void 0;if(key===void 0)continue;bindFsName(prop.value.name,key)}},CallExpression(node){pendingCalls.push(node)},"Program:exit"(){for(const call of pendingCalls)checkFsCall(call)}}}});

package/src/rules/detect-suspicious-dependencies/index.js

@@ -1,69 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectSuspiciousDependencies = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.detectSuspiciousDependencies = (0, eslint_devkit_1.createRule)({
-    name: 'detect-suspicious-dependencies',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-suspicious-dependencies.md',
-            description: 'Detect typosquatting in package names',
-            cwe: 'CWE-506',
-            cvss: 7.5,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Suspicious Dependency',
-                cwe: 'CWE-506',
-                description: 'Suspicious package name detected - possible typosquatting',
-                severity: 'HIGH',
-                fix: 'Verify package authenticity on npm registry',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/506.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        const popularPackages = ['react', 'lodash', 'express', 'axios', 'webpack'];
-        function levenshtein(a, b) {
-            const matrix = [];
-            for (let i = 0; i <= b.length; i++) {
-                matrix[i] = [i];
-            }
-            for (let j = 0; j <= a.length; j++) {
-                matrix[0][j] = j;
-            }
-            for (let i = 1; i <= b.length; i++) {
-                for (let j = 1; j <= a.length; j++) {
-                    if (b.charAt(i - 1) === a.charAt(j - 1)) {
-                        matrix[i][j] = matrix[i - 1][j - 1];
-                    }
-                    else {
-                        matrix[i][j] = Math.min(matrix[i - 1][j - 1] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j] + 1);
-                    }
-                }
-            }
-            return matrix[b.length][a.length];
-        }
-        return {
-            ImportDeclaration(node) {
-                const source = node.source.value;
-                if (typeof source === 'string' && !source.startsWith('.') && !source.startsWith('@')) {
-                    for (const popular of popularPackages) {
-                        const distance = levenshtein(source, popular);
-                        if (distance > 0 && distance <= 2) {
-                            context.report({
-                                node,
-                                messageId: 'violationDetected',
-                                data: { name: source, similar: popular },
-                            });
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.detectSuspiciousDependencies=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.detectSuspiciousDependencies=(0,eslint_devkit_1.createRule)({name:"detect-suspicious-dependencies",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/detect-suspicious-dependencies.md",description:"Detect typosquatting in package names",cwe:"CWE-506",cvss:7.5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Suspicious Dependency",cwe:"CWE-506",description:"Suspicious package name detected - possible typosquatting",severity:"HIGH",fix:"Verify package authenticity on npm registry",documentationLink:"https://cwe.mitre.org/data/definitions/506.html"})},schema:[]},defaultOptions:[],create(context){const popularPackages=["react","lodash","express","axios","webpack"];function levenshtein(a,b){const matrix=[];for(let i=0;i<=b.length;i++){matrix[i]=[i]}for(let j=0;j<=a.length;j++){matrix[0][j]=j}for(let i=1;i<=b.length;i++){for(let j=1;j<=a.length;j++){if(b.charAt(i-1)===a.charAt(j-1)){matrix[i][j]=matrix[i-1][j-1]}else{matrix[i][j]=Math.min(matrix[i-1][j-1]+1,matrix[i][j-1]+1,matrix[i-1][j]+1)}}}return matrix[b.length][a.length]}return{ImportDeclaration(node){const source=node.source.value;if(typeof source==="string"&&!source.startsWith(".")&&!source.startsWith("@")){for(const popular of popularPackages){const distance=levenshtein(source,popular);if(distance>0&&distance<=2){context.report({node,messageId:"violationDetected",data:{name:source,similar:popular}})}}}}}}});