eslint-plugin-operability 4.1.1 → 4.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-operability",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "ESLint plugin for production operability — bans debug code and console logging in production, verbose error messages, and process.exit calls.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/index.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.rules={get"no-console-log"(){return require("./rules/operability/no-console-log").noConsoleLog},get"no-process-exit"(){return require("./rules/operability/no-process-exit").noProcessExit},get"no-debug-code-in-production"(){return require("./rules/operability/no-debug-code-in-production").noDebugCodeInProduction},get"no-verbose-error-messages"(){return require("./rules/operability/no-verbose-error-messages").noVerboseErrorMessages},get"require-code-minification"(){return require("./rules/operability/require-code-minification").requireCodeMinification},get"require-data-minimization"(){return require("./rules/operability/require-data-minimization").requireDataMinimization},get"operability/no-console-log"(){return require("./rules/operability/no-console-log").noConsoleLog},get"operability/no-process-exit"(){return require("./rules/operability/no-process-exit").noProcessExit},get"operability/no-debug-code-in-production"(){return require("./rules/operability/no-debug-code-in-production").noDebugCodeInProduction},get"operability/no-verbose-error-messages"(){return require("./rules/operability/no-verbose-error-messages").noVerboseErrorMessages},get"operability/require-code-minification"(){return require("./rules/operability/require-code-minification").requireCodeMinification},get"operability/require-data-minimization"(){return require("./rules/operability/require-data-minimization").requireDataMinimization}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-operability",exports.rules);exports.plugin={meta:{name:"eslint-plugin-operability",version:"4.1.1"},rules:exports.rules};exports.configs={recommended:{plugins:{"operability":exports.plugin},rules:{"operability/no-console-log":"warn","operability/no-debug-code-in-production":"error","operability/no-verbose-error-messages":"warn"}}};exports.default=exports.plugin;
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.rules={get"no-console-log"(){return require("./rules/operability/no-console-log").noConsoleLog},get"no-process-exit"(){return require("./rules/operability/no-process-exit").noProcessExit},get"no-debug-code-in-production"(){return require("./rules/operability/no-debug-code-in-production").noDebugCodeInProduction},get"no-verbose-error-messages"(){return require("./rules/operability/no-verbose-error-messages").noVerboseErrorMessages},get"require-code-minification"(){return require("./rules/operability/require-code-minification").requireCodeMinification},get"require-data-minimization"(){return require("./rules/operability/require-data-minimization").requireDataMinimization},get"operability/no-console-log"(){return require("./rules/operability/no-console-log").noConsoleLog},get"operability/no-process-exit"(){return require("./rules/operability/no-process-exit").noProcessExit},get"operability/no-debug-code-in-production"(){return require("./rules/operability/no-debug-code-in-production").noDebugCodeInProduction},get"operability/no-verbose-error-messages"(){return require("./rules/operability/no-verbose-error-messages").noVerboseErrorMessages},get"operability/require-code-minification"(){return require("./rules/operability/require-code-minification").requireCodeMinification},get"operability/require-data-minimization"(){return require("./rules/operability/require-data-minimization").requireDataMinimization}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-operability",exports.rules);exports.plugin={meta:{name:"eslint-plugin-operability",version:"4.1.3"},rules:exports.rules};exports.configs={recommended:{plugins:{"operability":exports.plugin},rules:{"operability/no-console-log":"warn","operability/no-debug-code-in-production":"error","operability/no-verbose-error-messages":"warn"}}};exports.default=exports.plugin;

package/src/rules/operability/no-console-log.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noConsoleLog=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const eslint_devkit_3=require("@interlace/eslint-devkit");const non_production_paths_1=require("../../lib/non-production-paths");const DEFAULT_SEVERITY_MAP={log:"debug"};exports.noConsoleLog=(0,eslint_devkit_2.createRule)({name:"no-console-log",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-operability/docs/rules/no-console-log.md",description:"Disallow console.log with configurable remediation strategies",cwe:"CWE-532",cvss:5},fixable:"code",hasSuggestions:false,messages:{consoleLogFound:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.WARNING,issueName:"console.log in production",cwe:"CWE-532",description:"console.log found in production code",severity:"MEDIUM",fix:"Use logger.debug() or remove statement",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyRemove:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Remove Strategy",description:"Remove console.log statement",severity:"LOW",fix:"Delete the console.log statement",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyConvert:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Convert Strategy",description:"Convert to logger method",severity:"LOW",fix:"logger.debug() or logger.info()",documentationLink:"https://github.com/winstonjs/winston"}),strategyComment:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Comment Strategy",description:"Comment out console.log",severity:"LOW",fix:"// console.log(...)",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyWarn:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Warn Strategy",description:"Replace with console.warn()",severity:"LOW",fix:"console.warn()",documentationLink:"https://developer.mozilla.org/en-US/docs/Web/API/console/warn"})},schema:[{type:"object",properties:{strategy:{type:"string",enum:["remove","convert","comment","warn"],default:"remove",description:"Strategy for handling console.log"},ignoreNonProductionPaths:{type:"boolean",default:true},ignorePaths:{type:"array",items:{type:"string"},default:[],description:"File path patterns to ignore"},loggerName:{type:"string",default:"logger",description:'Name of the logger to use for convert strategy (e.g., "logger", "winston")'},maxOccurrences:{oneOf:[{type:"number",minimum:1,description:"Maximum number of occurrences to report"},{type:"string",enum:["all"],description:"Report all violations"}],description:'Maximum occurrences to report: number (e.g., 5), "all" (report all), or undefined (no limit)'},severityMap:{type:"object",additionalProperties:{type:"string"},default:{log:"debug"},description:'Advanced: Map console methods to logger methods, e.g., {"log": "info", "debug": "verbose"}'},autoDetectLogger:{type:"boolean",default:true,description:"Auto-detect logger import in file"},sourcePatterns:{type:"array",items:{type:"string"},default:["console"],description:'Object names to match and replace (e.g., ["console", "winston", "oldLogger"]). Uses exact string matching for safety.'}},additionalProperties:false}]},defaultOptions:[{strategy:"remove",ignorePaths:[],ignoreNonProductionPaths:true,loggerName:"logger",severityMap:{log:"log"},autoDetectLogger:true,sourcePatterns:["console"]}],create(context){const options=context.options[0]||{};const{strategy="remove",ignorePaths=[],ignoreNonProductionPaths=true,loggerName,maxOccurrences,severityMap={},autoDetectLogger=true,sourcePatterns=["console"]}=options;const effectiveSeverityMap={...DEFAULT_SEVERITY_MAP,...severityMap};const filename=context.filename;const sourceCode=context.sourceCode;const occurrences=[];let detectedLogger=null;if(autoDetectLogger){const ast=sourceCode.ast;const loggerPatterns=/^(logger|log|winston|bunyan|pino|console)$/i;for(const statement of ast.body){if(statement.type==="ImportDeclaration"){for(const specifier of statement.specifiers){if(specifier.type==="ImportDefaultSpecifier"||specifier.type==="ImportSpecifier"){const name=specifier.local.name;if(loggerPatterns.test(name)){detectedLogger=name;break}}}}if(statement.type==="VariableDeclaration"){for(const declarator of statement.declarations){if(declarator.init?.type==="CallExpression"&&declarator.init.callee.type==="Identifier"&&declarator.init.callee.name==="require"&&declarator.id.type==="Identifier"){const name=declarator.id.name;if(loggerPatterns.test(name)){detectedLogger=name;break}}}}if(detectedLogger)break}}const effectiveLogger=loggerName||detectedLogger||"logger";const shouldIgnoreFile=()=>{if(ignoreNonProductionPaths&&(0,non_production_paths_1.isNonProductionPath)(filename))return true;if(ignorePaths.length===0)return false;const normalizedPath=(0,eslint_devkit_3.normalizePath)(filename);return ignorePaths.some(pattern=>{const normalizedPattern=pattern.replace(/\\/g,"/");if(normalizedPath===normalizedPattern)return true;if(normalizedPath.startsWith(normalizedPattern+"/"))return true;const escaped=normalizedPattern.replace(/[.+^${}()|[\]\\*?]/g,"\\$&");const regexPattern=escaped.replace(/\\\*/g,".*").replace(/\\\?/g,".");return new RegExp(regexPattern).test(normalizedPath)})};if(shouldIgnoreFile()){return{}}return{CallExpression(node){if(node.callee.type!=="MemberExpression"||node.callee.object.type!=="Identifier"){return}const sourceObject=node.callee.object.name;const methodName=(0,eslint_devkit_1.propertyName)(node.callee);if(methodName===null){return}if(!sourcePatterns.includes(sourceObject)){return}if(!effectiveSeverityMap[methodName]){return}const line=node.loc?.start.line??0;occurrences.push(line);const shouldSkipReport=maxOccurrences!==void 0&&maxOccurrences!=="all"&&typeof maxOccurrences==="number"&&maxOccurrences>0&&occurrences.length>maxOccurrences;const relativePath=(0,eslint_devkit_3.getRelativePath)(process.cwd(),filename);const targetLoggerMethod=effectiveSeverityMap[methodName];const fix=fixer=>{const statement=findParentStatement(node);if(!statement)return null;switch(strategy){case"remove":return fixer.remove(statement);case"convert":return fixer.replaceText(node.callee,`${effectiveLogger}.${targetLoggerMethod}`);case"comment":{const text=sourceCode.getText(statement);return fixer.replaceText(statement,`// ${text}`)}case"warn":return fixer.replaceText(node.callee,"console.warn");default:return null}};let conversionInfo="";if(strategy==="convert"){conversionInfo=` \u2192 ${effectiveLogger}.${targetLoggerMethod}()`}if(!shouldSkipReport){context.report({node,messageId:"consoleLogFound",data:{consoleMethod:`${sourceObject}.${methodName}`,filePath:relativePath,line:String(line),strategy,conversionInfo,logger:effectiveLogger,method:targetLoggerMethod},fix})}}}}});function findParentStatement(node){let current=node;while(current){if(current.type==="ExpressionStatement"||current.type==="ReturnStatement"||current.type==="VariableDeclaration"){return current}current=current.parent}return null}
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.noConsoleLog=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");const eslint_devkit_2=require("@interlace/eslint-devkit");const eslint_devkit_3=require("@interlace/eslint-devkit");const non_production_paths_1=require("../../lib/non-production-paths");const DEFAULT_SEVERITY_MAP={log:"debug"};exports.noConsoleLog=(0,eslint_devkit_2.createRule)({name:"no-console-log",meta:{type:"problem",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-operability/docs/rules/no-console-log.md",description:"Disallow console.log with configurable remediation strategies",cwe:"CWE-532",cvss:5},fixable:"code",hasSuggestions:false,messages:{consoleLogFound:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.WARNING,issueName:"console.log in production",cwe:"CWE-532",description:"console.log found in production code",severity:"MEDIUM",fix:"Use logger.debug() or remove statement",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyRemove:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Remove Strategy",description:"Remove console.log statement",severity:"LOW",fix:"Delete the console.log statement",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyConvert:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Convert Strategy",description:"Convert to logger method",severity:"LOW",fix:"logger.debug() or logger.info()",documentationLink:"https://github.com/winstonjs/winston"}),strategyComment:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Comment Strategy",description:"Comment out console.log",severity:"LOW",fix:"// console.log(...)",documentationLink:"https://owasp.org/www-project-log-review-guide/"}),strategyWarn:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.STRATEGY,issueName:"Warn Strategy",description:"Replace with console.warn()",severity:"LOW",fix:"console.warn()",documentationLink:"https://developer.mozilla.org/en-US/docs/Web/API/console/warn"})},schema:[{type:"object",properties:{strategy:{type:"string",enum:["remove","convert","comment","warn"],default:"remove",description:"Strategy for handling console.log"},ignoreNonProductionPaths:{type:"boolean",default:true},ignorePaths:{type:"array",items:{type:"string"},default:[],description:"File path patterns to ignore"},loggerName:{type:"string",default:"logger",description:'Name of the logger to use for convert strategy (e.g., "logger", "winston")'},maxOccurrences:{oneOf:[{type:"number",minimum:1,description:"Maximum number of occurrences to report"},{type:"string",enum:["all"],description:"Report all violations"}],description:'Maximum occurrences to report: number (e.g., 5), "all" (report all), or undefined (no limit)'},severityMap:{type:"object",additionalProperties:{type:"string"},default:{log:"debug"},description:'Advanced: Map console methods to logger methods, e.g., {"log": "info", "debug": "verbose"}'},autoDetectLogger:{type:"boolean",default:true,description:"Auto-detect logger import in file"},sourcePatterns:{type:"array",items:{type:"string"},default:["console"],description:'Object names to match and replace (e.g., ["console", "winston", "oldLogger"]). Uses exact string matching for safety.'}},additionalProperties:false}]},defaultOptions:[{strategy:"remove",ignorePaths:[],ignoreNonProductionPaths:true,loggerName:"logger",severityMap:{log:"log"},autoDetectLogger:true,sourcePatterns:["console"]}],create(context){const options=context.options[0]||{};const{strategy="remove",ignorePaths=[],ignoreNonProductionPaths=true,loggerName,maxOccurrences,severityMap={},autoDetectLogger=true,sourcePatterns=["console"]}=options;const effectiveSeverityMap={...DEFAULT_SEVERITY_MAP,...severityMap};const filename=context.filename;const sourceCode=context.sourceCode;const occurrences=[];let detectedLogger=null;if(autoDetectLogger){const ast=sourceCode.ast;const loggerPatterns=/^(logger|log|winston|bunyan|pino|console)$/i;for(const statement of ast.body){if(statement.type==="ImportDeclaration"){for(const specifier of statement.specifiers){if(specifier.type==="ImportDefaultSpecifier"||specifier.type==="ImportSpecifier"){const name=specifier.local.name;if(loggerPatterns.test(name)){detectedLogger=name;break}}}}if(statement.type==="VariableDeclaration"){for(const declarator of statement.declarations){if(declarator.init?.type==="CallExpression"&&declarator.init.callee.type==="Identifier"&&declarator.init.callee.name==="require"&&declarator.id.type==="Identifier"){const name=declarator.id.name;if(loggerPatterns.test(name)){detectedLogger=name;break}}}}if(detectedLogger)break}}const effectiveLogger=loggerName||detectedLogger||"logger";const shouldIgnoreFile=()=>{if(ignoreNonProductionPaths&&(0,non_production_paths_1.isNonProductionPath)(filename))return true;if(ignorePaths.length===0)return false;const normalizedPath=(0,eslint_devkit_3.normalizePath)(filename);return ignorePaths.some(pattern=>{const normalizedPattern=pattern.replace(/\\/g,"/");if(normalizedPath===normalizedPattern)return true;if(normalizedPath.startsWith(normalizedPattern+"/"))return true;const escaped=normalizedPattern.replace(/[.+^${}()|[\]\\*?]/g,"\\$&");const regexPattern=escaped.replace(/\\\*/g,".*").replace(/\\\?/g,".");return new RegExp(regexPattern).test(normalizedPath)})};if(shouldIgnoreFile()){return{}}return{CallExpression(node){if(node.callee.type!=="MemberExpression"||node.callee.object.type!=="Identifier"){return}const sourceObject=node.callee.object.name;const methodName=(0,eslint_devkit_1.propertyName)(node.callee);if(methodName===null){return}if(!sourcePatterns.includes(sourceObject)){return}if(!effectiveSeverityMap[methodName]){return}const line=node.loc?.start.line??0;occurrences.push(line);const shouldSkipReport=maxOccurrences!==void 0&&maxOccurrences!=="all"&&typeof maxOccurrences==="number"&&maxOccurrences>0&&occurrences.length>maxOccurrences;const relativePath=(0,eslint_devkit_3.getRelativePath)(process.cwd(),filename);const targetLoggerMethod=effectiveSeverityMap[methodName];const fix=fixer=>{const statement=findParentStatement(node);if(!statement)return null;if(strategy==="remove"||strategy==="comment"){const wrapsCallExactly=statement.type==="ExpressionStatement"&&statement.expression===node;const parentType=statement.parent?.type;const inStatementList=parentType==="BlockStatement"||parentType==="Program"||parentType==="SwitchCase"||parentType==="StaticBlock";if(!wrapsCallExactly||!inStatementList)return null}switch(strategy){case"remove":return fixer.remove(statement);case"convert":return fixer.replaceText(node.callee,`${effectiveLogger}.${targetLoggerMethod}`);case"comment":{const text=sourceCode.getText(statement);return fixer.replaceText(statement,`// ${text}`)}case"warn":return fixer.replaceText(node.callee,"console.warn");default:return null}};let conversionInfo="";if(strategy==="convert"){conversionInfo=` \u2192 ${effectiveLogger}.${targetLoggerMethod}()`}if(!shouldSkipReport){context.report({node,messageId:"consoleLogFound",data:{consoleMethod:`${sourceObject}.${methodName}`,filePath:relativePath,line:String(line),strategy,conversionInfo,logger:effectiveLogger,method:targetLoggerMethod},fix})}}}}});function findParentStatement(node){let current=node;while(current){if(current.type==="ExpressionStatement"||current.type==="ReturnStatement"||current.type==="VariableDeclaration"){return current}current=current.parent}return null}

package/src/rules/operability/require-data-minimization.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.requireDataMinimization=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");exports.requireDataMinimization=(0,eslint_devkit_1.createRule)({name:"require-data-minimization",meta:{type:"suggestion",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-operability/docs/rules/require-data-minimization.md",description:"Identify excessive data collection patterns",cwe:"CWE-213",cvss:5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"violation Detected",cwe:"CWE-213",description:"Excessive data collection detected - only collect data that is necessary",severity:"MEDIUM",fix:"Review and apply secure practices",documentationLink:"https://cwe.mitre.org/data/definitions/213.html"})},schema:[{type:"object",properties:{piiFields:{type:"array",items:{type:"string"},description:"Property names this project treats as personal data. Replaces the default. Empty means the rule stays silent.",default:[]},maxProperties:{type:"number",description:"How many properties in one object literal count as excessive breadth.",default:10,minimum:1}},additionalProperties:false}]},defaultOptions:[{piiFields:[],maxProperties:10}],create(context,[options]){const piiFields=new Set(options.piiFields);const{maxProperties}=options;function report(node){context.report({node,messageId:"violationDetected"})}if(piiFields.size===0)return{};return{ObjectExpression(node){if(node.properties.length<=maxProperties)return;const carriesPersonalData=node.properties.some(p=>{if(p.type!==eslint_devkit_1.AST_NODE_TYPES.Property)return false;const name=(0,eslint_devkit_1.objectKeyName)(p);return name!==null&&piiFields.has(name)});if(carriesPersonalData)report(node)}}}});
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.requireDataMinimization=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");function isStaticValue(node,scope){if(node.type===eslint_devkit_1.AST_NODE_TYPES.ArrayExpression){return node.elements.every(element=>element!==null&&element.type!==eslint_devkit_1.AST_NODE_TYPES.SpreadElement&&isStaticValue(element,scope))}if(node.type===eslint_devkit_1.AST_NODE_TYPES.ObjectExpression){return node.properties.every(property=>property.type===eslint_devkit_1.AST_NODE_TYPES.Property&&isStaticValue(property.value,scope))}return(0,eslint_devkit_1.isStaticExpression)({node,scope})}exports.requireDataMinimization=(0,eslint_devkit_1.createRule)({name:"require-data-minimization",meta:{type:"suggestion",docs:{url:"https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-operability/docs/rules/require-data-minimization.md",description:"Identify excessive data collection patterns",cwe:"CWE-213",cvss:5},messages:{violationDetected:(0,eslint_devkit_1.formatLLMMessage)({icon:eslint_devkit_1.MessageIcons.SECURITY,issueName:"violation Detected",cwe:"CWE-213",description:"Excessive data collection detected - only collect data that is necessary",severity:"MEDIUM",fix:"Review and apply secure practices",documentationLink:"https://cwe.mitre.org/data/definitions/213.html"})},schema:[{type:"object",properties:{piiFields:{type:"array",items:{type:"string"},description:"Property names this project treats as personal data. Replaces the default. Empty means the rule stays silent.",default:[]},maxProperties:{type:"number",description:"How many properties in one object literal count as excessive breadth.",default:10,minimum:1}},additionalProperties:false}]},defaultOptions:[{piiFields:[],maxProperties:10}],create(context,[options]){const piiFields=new Set(options.piiFields);const{maxProperties}=options;function report(node){context.report({node,messageId:"violationDetected"})}if(piiFields.size===0)return{};return{ObjectExpression(node){if(node.properties.length<=maxProperties)return;const carriesPersonalData=node.properties.some(p=>{if(p.type!==eslint_devkit_1.AST_NODE_TYPES.Property)return false;const name=(0,eslint_devkit_1.objectKeyName)(p);return name!==null&&piiFields.has(name)});if(!carriesPersonalData)return;if(isStaticValue(node,context.sourceCode.getScope(node)))return;report(node)}}}});