eslint-plugin-node-security 4.8.0 → 4.9.0

package/src/rules/lock-file/index.js

@@ -1,92 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.lockFile = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.lockFile = (0, eslint_devkit_1.createRule)({
-    name: 'lock-file',
-    meta: {
-        type: 'suggestion',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/lock-file.md',
-            description: 'Ensure package lock file exists for the configured package manager',
-            cwe: 'CWE-829',
-            cvss: 7.5,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Lock File Missing',
-                cwe: 'CWE-829',
-                description: 'Package lock file missing ({{ lockFile }}) for {{ packageManager }}. Commit the lock file to ensure supply chain integrity.',
-                severity: 'HIGH',
-                fix: 'Generate and commit the {{ lockFile }} file.',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/829.html',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    packageManager: {
-                        type: 'string',
-                        enum: ['npm', 'yarn', 'pnpm'], description: 'Package manager whose lock file is required'
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [{}],
-    create(context) {
-        const fs = require('node:fs');
-        const path = require('node:path');
-        let checked = false;
-        const options = context.options[0] || {};
-        const userPackageManager = options.packageManager;
-        const lockFiles = {
-            npm: 'package-lock.json',
-            yarn: 'yarn.lock',
-            pnpm: 'pnpm-lock.yaml',
-        };
-        const targetLockFiles = userPackageManager
-            ? [lockFiles[userPackageManager]]
-            : Object.values(lockFiles);
-        const targetLockFile = userPackageManager
-            ? lockFiles[userPackageManager]
-            : 'package-lock.json | yarn.lock | pnpm-lock.yaml';
-        const reportedManager = userPackageManager ?? 'any';
-        return {
-            Program(node) {
-                if (checked)
-                    return;
-                checked = true;
-                let dir = path.dirname(context.filename);
-                let found = false;
-                for (let i = 0; i < 10; i++) {
-                    for (const lf of targetLockFiles) {
-                        if (fs.existsSync(path.join(dir, lf))) {
-                            found = true;
-                            break;
-                        }
-                    }
-                    if (found)
-                        break;
-                    const parentDir = path.dirname(dir);
-                    if (parentDir === dir)
-                        break;
-                    dir = parentDir;
-                }
-                if (!found) {
-                    context.report({
-                        node,
-                        messageId: 'violationDetected',
-                        data: {
-                            packageManager: reportedManager,
-                            lockFile: targetLockFile,
-                        }
-                    });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.lockFile=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.lockFile=(0,eslint_devkit_1.createRule)({name:"lock-file",meta:{type:"suggestion",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/lock-file.md",description:"Ensure package lock file exists for the configured package manager",cwe:"CWE-829",cvss:7.5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Lock File Missing",cwe:"CWE-829",description:"Package lock file missing ({{ lockFile }}) for {{ packageManager }}. Commit the lock file to ensure supply chain integrity.",severity:"HIGH",fix:"Generate and commit the {{ lockFile }} file.",documentationLink:"https://cwe.mitre.org/data/definitions/829.html"})},schema:[{type:"object",properties:{packageManager:{type:"string",enum:["npm","yarn","pnpm"],description:"Package manager whose lock file is required"}},additionalProperties:false}]},defaultOptions:[{}],create(context){const fs=require("node:fs");const path=require("node:path");let checked=false;const options=context.options[0]||{};const userPackageManager=options.packageManager;const lockFiles={npm:"package-lock.json",yarn:"yarn.lock",pnpm:"pnpm-lock.yaml"};const targetLockFiles=userPackageManager?[lockFiles[userPackageManager]]:Object.values(lockFiles);const targetLockFile=userPackageManager?lockFiles[userPackageManager]:"package-lock.json | yarn.lock | pnpm-lock.yaml";const reportedManager=userPackageManager??"any";return{Program(node){if(checked)return;checked=true;let dir=path.dirname(context.filename);let found=false;for(let i=0;i<10;i++){for(const lf of targetLockFiles){if(fs.existsSync(path.join(dir,lf))){found=true;break}}if(found)break;const parentDir=path.dirname(dir);if(parentDir===dir)break;dir=parentDir}if(!found){context.report({node,messageId:"violationDetected",data:{packageManager:reportedManager,lockFile:targetLockFile}})}}}}});

package/src/rules/no-arbitrary-file-access/index.js

@@ -1,152 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noArbitraryFileAccess = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
-    name: 'no-arbitrary-file-access',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-arbitrary-file-access.md',
-            description: 'Prevent file access from user input',
-            cwe: 'CWE-22',
-            cvss: 7.5,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Arbitrary File Access',
-                cwe: 'CWE-22',
-                description: 'File path from user input - path traversal vulnerability',
-                severity: 'HIGH',
-                fix: 'Validate and sanitize file paths, use allowlists',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        const sourceCode = context.sourceCode;
-        function report(node) {
-            context.report({ node, messageId: 'violationDetected' });
-        }
-        const fsReadMethods = ['readFile', 'readFileSync', 'readdir', 'readdirSync', 'stat', 'statSync'];
-        const fsWriteMethods = ['writeFile', 'writeFileSync', 'appendFile', 'appendFileSync'];
-        const userInputSources = new Set(['req', 'request', 'params', 'query', 'body']);
-        const sanitizedVariables = new Set();
-        const validatedVariables = new Set();
-        function checkVariableDeclaration(node) {
-            if (node.id.type !== 'Identifier' || !node.init) {
-                return;
-            }
-            const varName = node.id.name;
-            const init = node.init;
-            if (init.type === 'CallExpression' &&
-                init.callee.type === 'MemberExpression' &&
-                init.callee.object.type === 'Identifier' &&
-                init.callee.object.name === 'path' &&
-                init.callee.property.type === 'Identifier' &&
-                init.callee.property.name === 'basename') {
-                sanitizedVariables.add(varName);
-            }
-            if (init.type === 'CallExpression' &&
-                init.callee.type === 'MemberExpression' &&
-                init.callee.object.type === 'Identifier' &&
-                init.callee.object.name === 'path' &&
-                init.callee.property.type === 'Identifier' &&
-                init.callee.property.name === 'join') {
-                const hasSanitizedArg = init.arguments.some((arg) => arg.type === 'Identifier' && sanitizedVariables.has(arg.name));
-                const firstArg = init.arguments[0];
-                const hasSafeBase = firstArg && (firstArg.type === 'Literal' ||
-                    (firstArg.type === 'Identifier' && /^(SAFE|BASE|ROOT|UPLOAD|PUBLIC)/i.test(firstArg.name)));
-                if (hasSanitizedArg && hasSafeBase) {
-                    sanitizedVariables.add(varName);
-                }
-            }
-        }
-        function hasStartsWithGuard(node, varName) {
-            if (validatedVariables.has(varName)) {
-                return true;
-            }
-            let current = node.parent;
-            while (current) {
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
-                    const statements = current.body;
-                    for (const stmt of statements) {
-                        if (stmt.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                            const testText = sourceCode.getText(stmt.test).toLowerCase();
-                            if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
-                                const consequent = stmt.consequent;
-                                if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement && consequent.body.length > 0) {
-                                    const firstStmt = consequent.body[0];
-                                    if (firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
-                                        validatedVariables.add(varName);
-                                        return true;
-                                    }
-                                }
-                                if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
-                                    validatedVariables.add(varName);
-                                    return true;
-                                }
-                            }
-                        }
-                    }
-                }
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                    const testText = sourceCode.getText(current.test).toLowerCase();
-                    if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
-                        validatedVariables.add(varName);
-                        return true;
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        }
-        function isVariableSafe(varName, node) {
-            if (sanitizedVariables.has(varName)) {
-                return true;
-            }
-            if (hasStartsWithGuard(node, varName)) {
-                return true;
-            }
-            if (/^(safe|sanitized|validated|clean)/i.test(varName)) {
-                return true;
-            }
-            return false;
-        }
-        return {
-            VariableDeclarator(node) {
-                checkVariableDeclaration(node);
-            },
-            CallExpression(node) {
-                if (node.callee.type === 'MemberExpression' &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'fs' &&
-                    node.callee.property.type === 'Identifier' &&
-                    [...fsReadMethods, ...fsWriteMethods].includes(node.callee.property.name)) {
-                    const pathArg = node.arguments[0];
-                    if (pathArg && pathArg.type === 'Literal') {
-                        return;
-                    }
-                    if (pathArg && pathArg.type === 'Identifier') {
-                        const varName = pathArg.name;
-                        if (isVariableSafe(varName, node)) {
-                            return;
-                        }
-                        report(node);
-                        return;
-                    }
-                    if (pathArg?.type === 'MemberExpression' &&
-                        pathArg.object.type === 'Identifier') {
-                        const objName = pathArg.object.name.toLowerCase();
-                        if (userInputSources.has(objName)) {
-                            report(node);
-                        }
-                    }
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noArbitraryFileAccess=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noArbitraryFileAccess=(0,eslint_devkit_1.createRule)({name:"no-arbitrary-file-access",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-arbitrary-file-access.md",description:"Prevent file access from user input",cwe:"CWE-22",cvss:7.5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Arbitrary File Access",cwe:"CWE-22",description:"File path from user input - path traversal vulnerability",severity:"HIGH",fix:"Validate and sanitize file paths, use allowlists",documentationLink:"https://cwe.mitre.org/data/definitions/22.html"})},schema:[]},defaultOptions:[],create(context){const sourceCode=context.sourceCode;function report(node){context.report({node,messageId:"violationDetected"})}const fsReadMethods=["readFile","readFileSync","readdir","readdirSync","stat","statSync"];const fsWriteMethods=["writeFile","writeFileSync","appendFile","appendFileSync"];const userInputSources=new Set(["req","request","params","query","body"]);const sanitizedVariables=new Set;const validatedVariables=new Set;function checkVariableDeclaration(node){if(node.id.type!=="Identifier"||!node.init){return}const varName=node.id.name;const init=node.init;if(init.type==="CallExpression"&&init.callee.type==="MemberExpression"&&init.callee.object.type==="Identifier"&&init.callee.object.name==="path"&&init.callee.property.type==="Identifier"&&init.callee.property.name==="basename"){sanitizedVariables.add(varName)}if(init.type==="CallExpression"&&init.callee.type==="MemberExpression"&&init.callee.object.type==="Identifier"&&init.callee.object.name==="path"&&init.callee.property.type==="Identifier"&&init.callee.property.name==="join"){const hasSanitizedArg=init.arguments.some(arg=>arg.type==="Identifier"&&sanitizedVariables.has(arg.name));const firstArg=init.arguments[0];const hasSafeBase=firstArg&&(firstArg.type==="Literal"||firstArg.type==="Identifier"&&/^(SAFE|BASE|ROOT|UPLOAD|PUBLIC)/i.test(firstArg.name));if(hasSanitizedArg&&hasSafeBase){sanitizedVariables.add(varName)}}}function hasStartsWithGuard(node,varName){if(validatedVariables.has(varName)){return true}let current=node.parent;while(current){if(current.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement){const statements=current.body;for(const stmt of statements){if(stmt.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement){const testText=sourceCode.getText(stmt.test).toLowerCase();if(testText.includes("startswith")&&testText.includes(varName.toLowerCase())){const consequent=stmt.consequent;if(consequent.type===eslint_devkit_1.AST_NODE_TYPES.BlockStatement&&consequent.body.length>0){const firstStmt=consequent.body[0];if(firstStmt.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement||firstStmt.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement){validatedVariables.add(varName);return true}}if(consequent.type===eslint_devkit_1.AST_NODE_TYPES.ThrowStatement||consequent.type===eslint_devkit_1.AST_NODE_TYPES.ReturnStatement){validatedVariables.add(varName);return true}}}}}if(current.type===eslint_devkit_1.AST_NODE_TYPES.IfStatement){const testText=sourceCode.getText(current.test).toLowerCase();if(testText.includes("startswith")&&testText.includes(varName.toLowerCase())){validatedVariables.add(varName);return true}}current=current.parent}return false}function isVariableSafe(varName,node){if(sanitizedVariables.has(varName)){return true}if(hasStartsWithGuard(node,varName)){return true}if(/^(safe|sanitized|validated|clean)/i.test(varName)){return true}return false}return{VariableDeclarator(node){checkVariableDeclaration(node)},CallExpression(node){if(node.callee.type==="MemberExpression"&&node.callee.object.type==="Identifier"&&node.callee.object.name==="fs"&&node.callee.property.type==="Identifier"&&[...fsReadMethods,...fsWriteMethods].includes(node.callee.property.name)){const pathArg=node.arguments[0];if(pathArg&&pathArg.type==="Literal"){return}if(pathArg&&pathArg.type==="Identifier"){const varName=pathArg.name;if(isVariableSafe(varName,node)){return}report(node);return}if(pathArg?.type==="MemberExpression"&&pathArg.object.type==="Identifier"){const objName=pathArg.object.name.toLowerCase();if(userInputSources.has(objName)){report(node)}}}}}}});