eslint-plugin-node-security 4.8.0 → 4.9.0

package/src/rules/no-dynamic-command-string/index.js

@@ -1,201 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDynamicCommandString = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const ARGV_FUNCTIONS = new Set([
-    'spawn',
-    'spawnSync',
-    'execFile',
-    'execFileSync',
-    'fork',
-]);
-const POSIX_COMMAND_FLAGS = new Set(['-c']);
-const CMD_COMMAND_FLAGS = new Set(['/c', '/C', '/k', '/K']);
-const POWERSHELL_COMMAND_FLAGS = new Set([
-    '-Command',
-    '-command',
-    '-c',
-    '-EncodedCommand',
-    '-encodedcommand',
-    '-e',
-    '-ec',
-]);
-const SHELL_COMMAND_FLAGS = {
-    sh: POSIX_COMMAND_FLAGS,
-    bash: POSIX_COMMAND_FLAGS,
-    zsh: POSIX_COMMAND_FLAGS,
-    dash: POSIX_COMMAND_FLAGS,
-    ksh: POSIX_COMMAND_FLAGS,
-    busybox: POSIX_COMMAND_FLAGS,
-    cmd: CMD_COMMAND_FLAGS,
-    'cmd.exe': CMD_COMMAND_FLAGS,
-    powershell: POWERSHELL_COMMAND_FLAGS,
-    'powershell.exe': POWERSHELL_COMMAND_FLAGS,
-    pwsh: POWERSHELL_COMMAND_FLAGS,
-};
-const COMMAND_RUNNERS = new Set([
-    'execaCommand',
-    'execaCommandSync',
-    '$.raw',
-]);
-function basename(command) {
-    const segments = command.split(/[\\/]/);
-    return segments[segments.length - 1];
-}
-function isAssembledString(node) {
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral) {
-        return node.expressions.length > 0;
-    }
-    if (node.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression) {
-        return node.operator === '+';
-    }
-    return (node.type === eslint_devkit_1.AST_NODE_TYPES.Identifier ||
-        node.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression ||
-        node.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression);
-}
-function calleeName(callee) {
-    if (callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
-        return callee.name;
-    if (callee.type !== eslint_devkit_1.AST_NODE_TYPES.MemberExpression)
-        return null;
-    if (callee.property.type !== eslint_devkit_1.AST_NODE_TYPES.Identifier)
-        return null;
-    if (callee.computed)
-        return null;
-    if (callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-        callee.object.name === '$') {
-        return `$.${callee.property.name}`;
-    }
-    return callee.property.name;
-}
-exports.noDynamicCommandString = (0, eslint_devkit_1.createRule)({
-    name: 'no-dynamic-command-string',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-command-string.md',
-            description: 'Disallow dynamically assembled command strings passed to a shell flag or to a command-runner that does not escape (CWE-77)',
-            cwe: 'CWE-77',
-            cvss: 9.8,
-            confidence: 'high',
-        },
-        messages: {
-            shellFlagInjection: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Command Injection Through Shell Flag (CWE-77)',
-                cwe: 'CWE-77',
-                cvss: 9.8,
-                description: '{{fn}}("{{shell}}", ["{{flag}}", …]) hands a dynamically built string to {{shell}}, which parses it as a command line. The argument array looks parameterized but everything after {{flag}} is re-parsed — `;`, `&&`, backticks and `$()` all execute.',
-                severity: 'CRITICAL',
-                fix: 'Invoke the target program directly with its own argument array — spawn("kill", [String(pid)]) — instead of routing it through a shell.',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html',
-            }),
-            commandStringInterpolation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Interpolated Command Line (CWE-77)',
-                cwe: 'CWE-77',
-                cvss: 9.8,
-                description: '{{fn}}() takes a whole command line and does NOT escape interpolated values (unlike the execa/zx tagged-template forms). Any special character in the interpolated value changes which command runs.',
-                severity: 'CRITICAL',
-                fix: 'Use the tagged-template or array form that escapes for you: execa("git", ["clone", url]) or await $`git clone ${url}`.',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/77.html',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    extraCommandRunners: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        description: 'Extra functions that accept a full command line without escaping',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [{}],
-    create(context, [options]) {
-        const { extraCommandRunners } = options;
-        const runners = new Set([
-            ...COMMAND_RUNNERS,
-            ...(extraCommandRunners ?? []),
-        ]);
-        function checkShellFlag(node, fn) {
-            const command = node.arguments[0];
-            if (!command ||
-                command.type !== eslint_devkit_1.AST_NODE_TYPES.Literal ||
-                typeof command.value !== 'string') {
-                return;
-            }
-            const shell = basename(command.value);
-            const commandFlags = SHELL_COMMAND_FLAGS[shell.toLowerCase()];
-            if (!commandFlags)
-                return;
-            const argv = node.arguments[1];
-            if (!argv || argv.type !== eslint_devkit_1.AST_NODE_TYPES.ArrayExpression)
-                return;
-            for (let i = 0; i < argv.elements.length - 1; i += 1) {
-                const flag = argv.elements[i];
-                if (!flag || flag.type !== eslint_devkit_1.AST_NODE_TYPES.Literal)
-                    continue;
-                if (typeof flag.value !== 'string')
-                    continue;
-                if (!commandFlags.has(flag.value))
-                    continue;
-                const commandString = argv.elements[i + 1];
-                if (!commandString)
-                    continue;
-                if (!isAssembledString(commandString))
-                    continue;
-                context.report({
-                    node: commandString,
-                    messageId: 'shellFlagInjection',
-                    data: { fn, shell, flag: flag.value },
-                });
-                return;
-            }
-        }
-        function checkCommandRunner(node, fn) {
-            const commandLine = node.arguments[0];
-            if (!commandLine)
-                return;
-            if (commandLine.type === eslint_devkit_1.AST_NODE_TYPES.Literal)
-                return;
-            if (!isAssembledString(commandLine))
-                return;
-            context.report({
-                node: commandLine,
-                messageId: 'commandStringInterpolation',
-                data: { fn },
-            });
-        }
-        return {
-            CallExpression(node) {
-                const fn = calleeName(node.callee);
-                if (!fn)
-                    return;
-                if (ARGV_FUNCTIONS.has(fn)) {
-                    checkShellFlag(node, fn);
-                    return;
-                }
-                if (runners.has(fn)) {
-                    checkCommandRunner(node, fn);
-                }
-            },
-            TaggedTemplateExpression(node) {
-                const fn = calleeName(node.tag);
-                if (!fn || !runners.has(fn))
-                    return;
-                if (node.quasi.expressions.length === 0)
-                    return;
-                context.report({
-                    node: node.quasi,
-                    messageId: 'commandStringInterpolation',
-                    data: { fn },
-                });
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDynamicCommandString=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const ARGV_FUNCTIONS=new Set(["spawn","spawnSync","execFile","execFileSync","fork"]);const POSIX_COMMAND_FLAGS=new Set(["-c"]);const CMD_COMMAND_FLAGS=new Set(["/c","/C","/k","/K"]);const POWERSHELL_COMMAND_FLAGS=new Set(["-Command","-command","-c","-EncodedCommand","-encodedcommand","-e","-ec"]);const SHELL_COMMAND_FLAGS={sh:POSIX_COMMAND_FLAGS,bash:POSIX_COMMAND_FLAGS,zsh:POSIX_COMMAND_FLAGS,dash:POSIX_COMMAND_FLAGS,ksh:POSIX_COMMAND_FLAGS,busybox:POSIX_COMMAND_FLAGS,cmd:CMD_COMMAND_FLAGS,"cmd.exe":CMD_COMMAND_FLAGS,powershell:POWERSHELL_COMMAND_FLAGS,"powershell.exe":POWERSHELL_COMMAND_FLAGS,pwsh:POWERSHELL_COMMAND_FLAGS};const COMMAND_RUNNERS=new Set(["execaCommand","execaCommandSync","$.raw"]);function basename(command){const segments=command.split(/[\\/]/);return segments[segments.length-1]}function isAssembledString(node){if(node.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral){return node.expressions.length>0}if(node.type===eslint_devkit_1.AST_NODE_TYPES.BinaryExpression){return node.operator==="+"}return node.type===eslint_devkit_1.AST_NODE_TYPES.Identifier||node.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression||node.type===eslint_devkit_1.AST_NODE_TYPES.CallExpression}function calleeName(callee){if(callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier)return callee.name;if(callee.type!==eslint_devkit_1.AST_NODE_TYPES.MemberExpression)return null;if(callee.property.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return null;if(callee.computed)return null;if(callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&callee.object.name==="$"){return`$.${callee.property.name}`}return callee.property.name}exports.noDynamicCommandString=(0,eslint_devkit_1.createRule)({name:"no-dynamic-command-string",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-command-string.md",description:"Disallow dynamically assembled command strings passed to a shell flag or to a command-runner that does not escape (CWE-77)",cwe:"CWE-77",cvss:9.8,confidence:"high"},messages:{shellFlagInjection:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Command Injection Through Shell Flag (CWE-77)",cwe:"CWE-77",cvss:9.8,description:'{{fn}}("{{shell}}", ["{{flag}}", \u2026]) hands a dynamically built string to {{shell}}, which parses it as a command line. The argument array looks parameterized but everything after {{flag}} is re-parsed \u2014 `;`, `&&`, backticks and `$()` all execute.',severity:"CRITICAL",fix:'Invoke the target program directly with its own argument array \u2014 spawn("kill", [String(pid)]) \u2014 instead of routing it through a shell.',documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"}),commandStringInterpolation:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Interpolated Command Line (CWE-77)",cwe:"CWE-77",cvss:9.8,description:"{{fn}}() takes a whole command line and does NOT escape interpolated values (unlike the execa/zx tagged-template forms). Any special character in the interpolated value changes which command runs.",severity:"CRITICAL",fix:'Use the tagged-template or array form that escapes for you: execa("git", ["clone", url]) or await $`git clone ${url}`.',documentationLink:"https://cwe.mitre.org/data/definitions/77.html"})},schema:[{type:"object",properties:{extraCommandRunners:{type:"array",items:{type:"string"},description:"Extra functions that accept a full command line without escaping"}},additionalProperties:false}]},defaultOptions:[{}],create(context,[options]){const{extraCommandRunners}=options;const runners=new Set([...COMMAND_RUNNERS,...extraCommandRunners??[]]);function checkShellFlag(node,fn){const command=node.arguments[0];if(!command||command.type!==eslint_devkit_1.AST_NODE_TYPES.Literal||typeof command.value!=="string"){return}const shell=basename(command.value);const commandFlags=SHELL_COMMAND_FLAGS[shell.toLowerCase()];if(!commandFlags)return;const argv=node.arguments[1];if(!argv||argv.type!==eslint_devkit_1.AST_NODE_TYPES.ArrayExpression)return;for(let i=0;i<argv.elements.length-1;i+=1){const flag=argv.elements[i];if(!flag||flag.type!==eslint_devkit_1.AST_NODE_TYPES.Literal)continue;if(typeof flag.value!=="string")continue;if(!commandFlags.has(flag.value))continue;const commandString=argv.elements[i+1];if(!commandString)continue;if(!isAssembledString(commandString))continue;context.report({node:commandString,messageId:"shellFlagInjection",data:{fn,shell,flag:flag.value}});return}}function checkCommandRunner(node,fn){const commandLine=node.arguments[0];if(!commandLine)return;if(commandLine.type===eslint_devkit_1.AST_NODE_TYPES.Literal)return;if(!isAssembledString(commandLine))return;context.report({node:commandLine,messageId:"commandStringInterpolation",data:{fn}})}return{CallExpression(node){const fn=calleeName(node.callee);if(!fn)return;if(ARGV_FUNCTIONS.has(fn)){checkShellFlag(node,fn);return}if(runners.has(fn)){checkCommandRunner(node,fn)}},TaggedTemplateExpression(node){const fn=calleeName(node.tag);if(!fn||!runners.has(fn))return;if(node.quasi.expressions.length===0)return;context.report({node:node.quasi,messageId:"commandStringInterpolation",data:{fn}})}}}});

package/src/rules/no-dynamic-dependency-loading/index.js

@@ -1,45 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDynamicDependencyLoading = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noDynamicDependencyLoading = (0, eslint_devkit_1.createRule)({
-    name: 'no-dynamic-dependency-loading',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-dependency-loading.md',
-            description: 'Prevent runtime dependency injection with dynamic paths',
-            cwe: 'CWE-1104',
-            cvss: 5.3,
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'violation Detected',
-                cwe: 'CWE-1104',
-                description: 'Dynamic import/require detected - use static imports for security',
-                severity: 'HIGH',
-                fix: 'Review and apply secure practices',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/1104.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        return {
-            CallExpression(node) {
-                if (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    node.callee.name === 'require' &&
-                    node.arguments[0]?.type !== eslint_devkit_1.AST_NODE_TYPES.Literal) {
-                    context.report({ node, messageId: 'violationDetected' });
-                }
-            },
-            ImportExpression(node) {
-                if (node.source.type !== 'Literal') {
-                    context.report({ node, messageId: 'violationDetected' });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDynamicDependencyLoading=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noDynamicDependencyLoading=(0,eslint_devkit_1.createRule)({name:"no-dynamic-dependency-loading",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-dependency-loading.md",description:"Prevent runtime dependency injection with dynamic paths",cwe:"CWE-1104",cvss:5.3},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"violation Detected",cwe:"CWE-1104",description:"Dynamic import/require detected - use static imports for security",severity:"HIGH",fix:"Review and apply secure practices",documentationLink:"https://cwe.mitre.org/data/definitions/1104.html"})},schema:[]},defaultOptions:[],create(context){return{CallExpression(node){if(node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.name==="require"&&node.arguments[0]?.type!==eslint_devkit_1.AST_NODE_TYPES.Literal){context.report({node,messageId:"violationDetected"})}},ImportExpression(node){if(node.source.type!=="Literal"){context.report({node,messageId:"violationDetected"})}}}}});

package/src/rules/no-dynamic-require/index.js

@@ -1,96 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noDynamicRequire = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
-    name: 'no-dynamic-require',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-require.md',
-            description: 'Forbid `require()` calls with expressions',
-            cwe: 'CWE-94',
-            cweJustification: 'CWE-94 (Improper Control of Generation of Code) — dynamic require with attacker-influenced path can load arbitrary modules, equivalent to remote code execution.',
-            confidence: 'high',
-        },
-        hasSuggestions: false,
-        messages: {
-            dynamicRequire: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.WARNING,
-                issueName: 'Dynamic Require',
-                description: 'Require call uses dynamic expression',
-                severity: 'HIGH',
-                fix: 'Use static string literals for require() calls',
-                documentationLink: 'https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-dynamic-require.md',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowContexts: {
-                        type: 'array',
-                        items: {
-                            type: 'string',
-                            enum: ['test', 'config', 'build', 'runtime'],
-                        },
-                        description: 'Allow dynamic requires in specific contexts.',
-                    },
-                    allowPatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        description: 'Regex patterns for allowed dynamic require paths.',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [{
-            allowContexts: [],
-            allowPatterns: []
-        }],
-    create(context) {
-        const [options] = context.options;
-        const { allowContexts = [], } = options || {};
-        const filename = context.filename || '';
-        function isInAllowedContext() {
-            if (allowContexts.includes('test') && (filename.includes('.test.') || filename.includes('.spec.') || filename.includes('/__tests__/'))) {
-                return true;
-            }
-            if (allowContexts.includes('config') && (filename.includes('config') || filename.includes('webpack') || filename.includes('rollup'))) {
-                return true;
-            }
-            if (allowContexts.includes('build') && (filename.includes('build') || filename.includes('scripts') || filename.includes('tools'))) {
-                return true;
-            }
-            if (allowContexts.includes('runtime') && (filename.includes('runtime') || filename.includes('dynamic'))) {
-                return true;
-            }
-            return false;
-        }
-        function isStaticLiteral(node) {
-            return node.type === 'Literal' && typeof node.value === 'string';
-        }
-        return {
-            CallExpression(node) {
-                if (node.callee.type === 'Identifier' &&
-                    node.callee.name === 'require' &&
-                    node.arguments.length === 1) {
-                    const requireArg = node.arguments[0];
-                    if (isInAllowedContext()) {
-                        return;
-                    }
-                    if (isStaticLiteral(requireArg)) {
-                        return;
-                    }
-                    context.report({
-                        node: requireArg,
-                        messageId: 'dynamicRequire',
-                    });
-                }
-            },
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noDynamicRequire=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");exports.noDynamicRequire=(0,eslint_devkit_1.createRule)({name:"no-dynamic-require",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-dynamic-require.md",description:"Forbid `require()` calls with expressions",cwe:"CWE-94",cweJustification:"CWE-94 (Improper Control of Generation of Code) \u2014 dynamic require with attacker-influenced path can load arbitrary modules, equivalent to remote code execution.",confidence:"high"},hasSuggestions:false,messages:{dynamicRequire:(0,eslint_devkit_2.formatLLMMessage)({icon:eslint_devkit_2.MessageIcons.WARNING,issueName:"Dynamic Require",description:"Require call uses dynamic expression",severity:"HIGH",fix:"Use static string literals for require() calls",documentationLink:"https://github.com/import-js/eslint-plugin-import/blob/main/docs/rules/no-dynamic-require.md"})},schema:[{type:"object",properties:{allowContexts:{type:"array",items:{type:"string",enum:["test","config","build","runtime"]},description:"Allow dynamic requires in specific contexts."},allowPatterns:{type:"array",items:{type:"string"},description:"Regex patterns for allowed dynamic require paths."}},additionalProperties:false}]},defaultOptions:[{allowContexts:[],allowPatterns:[]}],create(context){const[options]=context.options;const{allowContexts=[]}=options||{};const filename=context.filename||"";function isInAllowedContext(){if(allowContexts.includes("test")&&(filename.includes(".test.")||filename.includes(".spec.")||filename.includes("/__tests__/"))){return true}if(allowContexts.includes("config")&&(filename.includes("config")||filename.includes("webpack")||filename.includes("rollup"))){return true}if(allowContexts.includes("build")&&(filename.includes("build")||filename.includes("scripts")||filename.includes("tools"))){return true}if(allowContexts.includes("runtime")&&(filename.includes("runtime")||filename.includes("dynamic"))){return true}return false}function isStaticLiteral(node){return node.type==="Literal"&&typeof node.value==="string"}return{CallExpression(node){if(node.callee.type==="Identifier"&&node.callee.name==="require"&&node.arguments.length===1){const requireArg=node.arguments[0];if(isInAllowedContext()){return}if(isStaticLiteral(requireArg)){return}context.report({node:requireArg,messageId:"dynamicRequire"})}}}}});

package/src/rules/no-ecb-mode/index.js

@@ -1,108 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noEcbMode = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noEcbMode = (0, eslint_devkit_1.createRule)({
-    name: 'no-ecb-mode',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ecb-mode.md',
-            description: 'Disallow ECB encryption mode (use GCM or CBC instead)',
-            cwe: 'CWE-327',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            ecbMode: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'ECB mode detected',
-                cwe: 'CWE-327',
-                description: 'ECB mode encrypts identical plaintext blocks to identical ciphertext, leaking data patterns. Famous example: the "ECB penguin".',
-                severity: 'HIGH',
-                fix: 'Use GCM mode for authenticated encryption: crypto.createCipheriv("aes-256-gcm", key, iv)',
-                documentationLink: 'https://blog.cloudflare.com/why-are-some-images-more-secure-than-others/',
-            }),
-            useGcm: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use GCM mode',
-                description: 'GCM provides authenticated encryption (confidentiality + integrity)',
-                severity: 'LOW',
-                fix: 'crypto.createCipheriv("aes-256-gcm", key, iv)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-            useCbc: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use CBC mode',
-                description: 'CBC with HMAC provides confidentiality (add separate MAC for integrity)',
-                severity: 'LOW',
-                fix: 'crypto.createCipheriv("aes-256-cbc", key, iv)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow ECB mode in test files',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false } = options;
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        function checkCallExpression(node) {
-            if (isTestFile)
-                return;
-            const cipherMethods = new Set(['createCipher', 'createCipheriv', 'createDecipher', 'createDecipheriv']);
-            const isCipherCall = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                cipherMethods.has(node.callee.property.name)) ||
-                (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    cipherMethods.has(node.callee.name));
-            if (isCipherCall && node.arguments.length >= 1) {
-                const algorithmArg = node.arguments[0];
-                if (algorithmArg.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof algorithmArg.value === 'string') {
-                    const algorithm = algorithmArg.value.toLowerCase();
-                    if (algorithm.includes('-ecb') || algorithm.endsWith('ecb')) {
-                        const gcmReplacement = algorithm.replace(/-?ecb$/, '-gcm');
-                        context.report({
-                            node: algorithmArg,
-                            messageId: 'ecbMode',
-                            suggest: [
-                                {
-                                    messageId: 'useGcm',
-                                    fix: (fixer) => {
-                                        return fixer.replaceText(algorithmArg, `"${gcmReplacement}"`);
-                                    },
-                                },
-                                {
-                                    messageId: 'useCbc',
-                                    fix: (fixer) => {
-                                        const cbcReplacement = algorithm.replace(/-?ecb$/, '-cbc');
-                                        return fixer.replaceText(algorithmArg, `"${cbcReplacement}"`);
-                                    },
-                                },
-                            ],
-                        });
-                    }
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noEcbMode=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.noEcbMode=(0,eslint_devkit_1.createRule)({name:"no-ecb-mode",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-ecb-mode.md",description:"Disallow ECB encryption mode (use GCM or CBC instead)",cwe:"CWE-327",cvss:7.5},hasSuggestions:true,messages:{ecbMode:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"ECB mode detected",cwe:"CWE-327",description:'ECB mode encrypts identical plaintext blocks to identical ciphertext, leaking data patterns. Famous example: the "ECB penguin".',severity:"HIGH",fix:'Use GCM mode for authenticated encryption: crypto.createCipheriv("aes-256-gcm", key, iv)',documentationLink:"https://blog.cloudflare.com/why-are-some-images-more-secure-than-others/"}),useGcm:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use GCM mode",description:"GCM provides authenticated encryption (confidentiality + integrity)",severity:"LOW",fix:'crypto.createCipheriv("aes-256-gcm", key, iv)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"}),useCbc:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use CBC mode",description:"CBC with HMAC provides confidentiality (add separate MAC for integrity)",severity:"LOW",fix:'crypto.createCipheriv("aes-256-cbc", key, iv)',documentationLink:"https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options"})},schema:[{type:"object",properties:{allowInTests:{type:"boolean",default:false,description:"Allow ECB mode in test files"}},additionalProperties:false}]},defaultOptions:[{allowInTests:false}],create(context,[options={}]){const{allowInTests=false}=options;const filename=context.filename;const isTestFile=allowInTests&&/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);function checkCallExpression(node){if(isTestFile)return;const cipherMethods=new Set(["createCipher","createCipheriv","createDecipher","createDecipheriv"]);const isCipherCall=node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&cipherMethods.has(node.callee.property.name)||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&cipherMethods.has(node.callee.name);if(isCipherCall&&node.arguments.length>=1){const algorithmArg=node.arguments[0];if(algorithmArg.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof algorithmArg.value==="string"){const algorithm=algorithmArg.value.toLowerCase();if(algorithm.includes("-ecb")||algorithm.endsWith("ecb")){const gcmReplacement=algorithm.replace(/-?ecb$/,"-gcm");context.report({node:algorithmArg,messageId:"ecbMode",suggest:[{messageId:"useGcm",fix:fixer=>{return fixer.replaceText(algorithmArg,`"${gcmReplacement}"`)}},{messageId:"useCbc",fix:fixer=>{const cbcReplacement=algorithm.replace(/-?ecb$/,"-cbc");return fixer.replaceText(algorithmArg,`"${cbcReplacement}"`)}}]})}}}}return{CallExpression:checkCallExpression}}});

package/src/rules/no-insecure-key-derivation/index.js

@@ -1,109 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noInsecureKeyDerivation = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const DEFAULT_MIN_ITERATIONS = 100000;
-exports.noInsecureKeyDerivation = (0, eslint_devkit_1.createRule)({
-    name: 'no-insecure-key-derivation',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-key-derivation.md',
-            description: 'Disallow PBKDF2 with insufficient iterations (< 100,000)',
-            cwe: 'CWE-916',
-            cvss: 7.5,
-        },
-        hasSuggestions: true,
-        messages: {
-            insufficientIterations: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Insufficient PBKDF2 iterations',
-                cwe: 'CWE-916',
-                description: 'PBKDF2 with {{actual}} iterations is too low. Minimum recommended: {{minimum}} iterations (OWASP 2023).',
-                severity: 'HIGH',
-                fix: 'Increase iterations to at least {{minimum}}, or use scrypt/Argon2',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html',
-            }),
-            useMinIterations: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use minimum iterations',
-                description: 'Use at least {{minimum}} iterations for PBKDF2',
-                severity: 'LOW',
-                fix: 'crypto.pbkdf2(password, salt, {{minimum}}, keylen, digest)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptopbkdf2password-salt-iterations-keylen-digest-callback',
-            }),
-            useScrypt: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use scrypt',
-                description: 'scrypt is memory-hard and resistant to GPU/ASIC attacks',
-                severity: 'LOW',
-                fix: 'crypto.scrypt(password, salt, keylen)',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptoscryptpassword-salt-keylen-options-callback',
-            }),
-            useArgon2: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Argon2',
-                description: 'Argon2id is the winner of the Password Hashing Competition',
-                severity: 'LOW',
-                fix: 'argon2.hash(password, { type: argon2.argon2id })',
-                documentationLink: 'https://github.com/ranisalt/node-argon2',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    minIterations: {
-                        type: 'number',
-                        default: DEFAULT_MIN_ITERATIONS,
-                        description: 'Minimum required PBKDF2 iterations',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            minIterations: DEFAULT_MIN_ITERATIONS,
-        },
-    ],
-    create(context, [options = {}]) {
-        const { minIterations = DEFAULT_MIN_ITERATIONS } = options;
-        function checkCallExpression(node) {
-            const isPbkdf2Call = (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
-                node.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                (node.callee.property.name === 'pbkdf2' || node.callee.property.name === 'pbkdf2Sync')) ||
-                (node.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
-                    (node.callee.name === 'pbkdf2' || node.callee.name === 'pbkdf2Sync'));
-            if (isPbkdf2Call) {
-                const iterationsArg = node.arguments[2];
-                if (iterationsArg?.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof iterationsArg.value === 'number') {
-                    const iterations = iterationsArg.value;
-                    if (iterations < minIterations) {
-                        context.report({
-                            node: iterationsArg,
-                            messageId: 'insufficientIterations',
-                            data: {
-                                actual: String(iterations),
-                                minimum: String(minIterations),
-                            },
-                            suggest: [
-                                {
-                                    messageId: 'useMinIterations',
-                                    data: { minimum: String(minIterations) },
-                                    fix: (fixer) => {
-                                        return fixer.replaceText(iterationsArg, String(minIterations));
-                                    },
-                                },
-                            ],
-                        });
-                    }
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noInsecureKeyDerivation=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const DEFAULT_MIN_ITERATIONS=1e5;exports.noInsecureKeyDerivation=(0,eslint_devkit_1.createRule)({name:"no-insecure-key-derivation",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-node-security/docs/rules/no-insecure-key-derivation.md",description:"Disallow PBKDF2 with insufficient iterations (< 100,000)",cwe:"CWE-916",cvss:7.5},hasSuggestions:true,messages:{insufficientIterations:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"Insufficient PBKDF2 iterations",cwe:"CWE-916",description:"PBKDF2 with {{actual}} iterations is too low. Minimum recommended: {{minimum}} iterations (OWASP 2023).",severity:"HIGH",fix:"Increase iterations to at least {{minimum}}, or use scrypt/Argon2",documentationLink:"https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}),useMinIterations:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use minimum iterations",description:"Use at least {{minimum}} iterations for PBKDF2",severity:"LOW",fix:"crypto.pbkdf2(password, salt, {{minimum}}, keylen, digest)",documentationLink:"https://nodejs.org/api/crypto.html#cryptopbkdf2password-salt-iterations-keylen-digest-callback"}),useScrypt:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use scrypt",description:"scrypt is memory-hard and resistant to GPU/ASIC attacks",severity:"LOW",fix:"crypto.scrypt(password, salt, keylen)",documentationLink:"https://nodejs.org/api/crypto.html#cryptoscryptpassword-salt-keylen-options-callback"}),useArgon2:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.INFO,issueName:"Use Argon2",description:"Argon2id is the winner of the Password Hashing Competition",severity:"LOW",fix:"argon2.hash(password, { type: argon2.argon2id })",documentationLink:"https://github.com/ranisalt/node-argon2"})},schema:[{type:"object",properties:{minIterations:{type:"number",default:DEFAULT_MIN_ITERATIONS,description:"Minimum required PBKDF2 iterations"}},additionalProperties:false}]},defaultOptions:[{minIterations:DEFAULT_MIN_ITERATIONS}],create(context,[options={}]){const{minIterations=DEFAULT_MIN_ITERATIONS}=options;function checkCallExpression(node){const isPbkdf2Call=node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&node.callee.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.callee.property.name==="pbkdf2"||node.callee.property.name==="pbkdf2Sync")||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&(node.callee.name==="pbkdf2"||node.callee.name==="pbkdf2Sync");if(isPbkdf2Call){const iterationsArg=node.arguments[2];if(iterationsArg?.type===eslint_devkit_1.AST_NODE_TYPES.Literal&&typeof iterationsArg.value==="number"){const iterations=iterationsArg.value;if(iterations<minIterations){context.report({node:iterationsArg,messageId:"insufficientIterations",data:{actual:String(iterations),minimum:String(minIterations)},suggest:[{messageId:"useMinIterations",data:{minimum:String(minIterations)},fix:fixer=>{return fixer.replaceText(iterationsArg,String(minIterations))}}]})}}}}return{CallExpression:checkCallExpression}}});