eslint-plugin-node-security 4.9.1 → 4.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/README.md +29 -23
  2. package/package.json +2 -2
  3. package/src/index.js +1 -1
  4. package/src/rules/detect-child-process/index.js +1 -1
  5. package/src/rules/detect-eval-with-expression/index.js +1 -1
  6. package/src/rules/detect-non-literal-fs-filename/index.js +1 -1
  7. package/src/rules/detect-suspicious-dependencies/index.js +1 -1
  8. package/src/rules/lock-file/index.js +1 -1
  9. package/src/rules/no-arbitrary-file-access/index.js +1 -1
  10. package/src/rules/no-buffer-overread/index.js +1 -1
  11. package/src/rules/no-data-in-temp-storage/index.js +1 -1
  12. package/src/rules/no-dynamic-algorithm-selection/index.js +1 -1
  13. package/src/rules/no-env-injection/index.js +1 -0
  14. package/src/rules/no-insecure-http-parser/index.js +1 -0
  15. package/src/rules/no-math-random-crypto/index.js +1 -1
  16. package/src/rules/no-shell-injection/index.js +1 -1
  17. package/src/rules/no-ssrf/index.js +1 -1
  18. package/src/rules/no-timing-unsafe-compare/index.js +1 -1
  19. package/src/rules/no-toctou-vulnerability/index.js +1 -1
  20. package/src/rules/no-unbounded-decompression/index.js +1 -0
  21. package/src/rules/no-unsafe-buffer-alloc/index.js +1 -1
  22. package/src/rules/no-unsafe-dynamic-require/index.js +1 -1
  23. package/src/rules/no-weak-hash-algorithm/index.js +1 -1
  24. package/src/rules/no-zip-slip/index.js +1 -1
  25. package/src/rules/require-aead-tag-verification/index.js +1 -0
  26. package/src/rules/require-dependency-integrity/index.js +1 -1
  27. package/src/rules/require-stream-error-handler/index.js +1 -0
  28. package/src/utils/constant-folding.js +1 -0
  29. package/src/utils/names.js +1 -0
  30. package/src/utils/provenance.js +1 -0
package/src/utils/names.js ADDED
@@ -0,0 +1 @@
1
+ "use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.identifierWords=identifierWords;exports.makeNameTest=makeNameTest;function identifierWords(name){return name.replaceAll(/([a-z0-9])([A-Z])/g,"$1 $2").replaceAll(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").split(/[^a-zA-Z0-9]+/).filter(Boolean).map(word=>word.toLowerCase())}function makeNameTest(names){const wanted=new Set(names.map(entry=>entry.toLowerCase()));const substrings=[...wanted].filter(entry=>entry.length>=6);return name=>{const words=identifierWords(name);if(words.some(word=>wanted.has(word)))return true;const joined=words.join("");return substrings.some(entry=>joined.includes(entry))}}
package/src/utils/provenance.js ADDED
@@ -0,0 +1 @@
1
+ "use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.findVariable=findVariable;exports.bindingInit=bindingInit;exports.constLiteralOf=constLiteralOf;exports.makeReadsTaintSource=makeReadsTaintSource;const eslint_devkit_1=require("@interlace/eslint-devkit");function findVariable(sourceCode,node){let scope=sourceCode.getScope(node);while(scope){const found=scope.set?.get(node.name);if(found)return found;scope=scope.upper}return null}function bindingInit(sourceCode,node){const variable=findVariable(sourceCode,node);if(!variable||variable.defs.length!==1)return void 0;const def=variable.defs[0];if(def.type!=="Variable")return void 0;return def.node.init??void 0}function constLiteralOf(sourceCode,node){const variable=findVariable(sourceCode,node);if(!variable||variable.defs.length!==1)return void 0;const def=variable.defs[0];if(def.type!=="Variable")return void 0;if(def.parent.kind!=="const")return void 0;if(def.node.id.type!==eslint_devkit_1.AST_NODE_TYPES.Identifier)return void 0;const init=def.node.init;if(!init)return void 0;if(init.type===eslint_devkit_1.AST_NODE_TYPES.Literal)return init;if(init.type===eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral&&init.expressions.length===0){return init}return void 0}const REQUEST_PROPERTY_NAMES=new Set(["headers","query","body","params","cookies","searchparams","rawbody","querystringparameters","pathparameters","formdata"]);function makeReadsTaintSource(sourceCode,roots){const reads=(node,depth)=>{if(depth>6)return false;switch(node.type){case eslint_devkit_1.AST_NODE_TYPES.Identifier:{if(roots.has(node.name.toLowerCase()))return true;const init=bindingInit(sourceCode,node);return init!==void 0&&reads(init,depth+1)}case eslint_devkit_1.AST_NODE_TYPES.MemberExpression:{if(!node.computed&&node.property.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&REQUEST_PROPERTY_NAMES.has(node.property.name.toLowerCase())){return true}return reads(node.object,depth+1)}case eslint_devkit_1.AST_NODE_TYPES.TemplateLiteral:return node.expressions.some(expression=>reads(expression,depth+1));case eslint_devkit_1.AST_NODE_TYPES.BinaryExpression:return reads(node.left,depth+1)||reads(node.right,depth+1);case eslint_devkit_1.AST_NODE_TYPES.AwaitExpression:return reads(node.argument,depth+1);case eslint_devkit_1.AST_NODE_TYPES.ArrayExpression:return node.elements.some(element=>element!==null&&reads(element,depth+1));case eslint_devkit_1.AST_NODE_TYPES.SpreadElement:return reads(node.argument,depth+1);case eslint_devkit_1.AST_NODE_TYPES.CallExpression:case eslint_devkit_1.AST_NODE_TYPES.NewExpression:return node.arguments.some(argument=>reads(argument,depth+1))||node.callee.type===eslint_devkit_1.AST_NODE_TYPES.MemberExpression&&!(node.callee.object.type===eslint_devkit_1.AST_NODE_TYPES.Identifier&&node.callee.object.name==="process")&&reads(node.callee.object,depth+1);default:return false}};return node=>reads(node,0)}