eslint-plugin-sdl-2 1.0.4

package/dist/rules/no-node-tls-security-level-zero.js

@@ -0,0 +1,80 @@
+import { createRule } from "../_internal/create-rule.js";
+import { getPropertyName, getStaticStringValue, } from "../_internal/estree-utils.js";
+import { isNodeTlsStaticMember, isRelevantNodeTlsOptionsObject, } from "../_internal/node-tls-config.js";
+const TLS_DEFAULT_CIPHERS_PROPERTY_NAMES = new Set(["DEFAULT_CIPHERS"]);
+const TLS_SECURITY_LEVEL_ZERO_PATTERN = /@seclevel\s*=\s*0\b/iu;
+const isExpressionNode = (node) => node.type !== "ArrayPattern" &&
+    node.type !== "AssignmentPattern" &&
+    node.type !== "ObjectPattern";
+const isSecurityLevelZeroCipherString = (value) => TLS_SECURITY_LEVEL_ZERO_PATTERN.test(value);
+/** Rule implementation. */
+const rule = createRule({
+    create(context) {
+        return {
+            AssignmentExpression(node) {
+                if (node.operator !== "=" ||
+                    !isNodeTlsStaticMember(node.left, TLS_DEFAULT_CIPHERS_PROPERTY_NAMES)) {
+                    return;
+                }
+                const configuredValue = getStaticStringValue(node.right);
+                if (typeof configuredValue !== "string" ||
+                    !isSecurityLevelZeroCipherString(configuredValue)) {
+                    return;
+                }
+                context.report({
+                    data: {
+                        configuredValue,
+                        propertyName: "DEFAULT_CIPHERS",
+                    },
+                    messageId: "default",
+                    node: node.right,
+                });
+            },
+            ObjectExpression(node) {
+                if (!isRelevantNodeTlsOptionsObject(node)) {
+                    return;
+                }
+                for (const propertyNode of node.properties) {
+                    if (propertyNode.type !== "Property" ||
+                        propertyNode.kind !== "init" ||
+                        getPropertyName(propertyNode) !== "ciphers" ||
+                        !isExpressionNode(propertyNode.value)) {
+                        continue;
+                    }
+                    const configuredValue = getStaticStringValue(propertyNode.value);
+                    if (typeof configuredValue !== "string" ||
+                        !isSecurityLevelZeroCipherString(configuredValue)) {
+                        continue;
+                    }
+                    context.report({
+                        data: {
+                            configuredValue,
+                            propertyName: "ciphers",
+                        },
+                        messageId: "default",
+                        node: propertyNode.value,
+                    });
+                }
+            },
+        };
+    },
+    defaultOptions: [],
+    meta: {
+        deprecated: false,
+        docs: {
+            description: "disallow lowering Node.js TLS cipher security to OpenSSL security level 0.",
+            frozen: false,
+            recommended: false,
+            url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-node-tls-security-level-zero",
+        },
+        messages: {
+            default: "Do not lower TLS cipher security with {{propertyName}}={{configuredValue}}; keep Node's default security level or use a reviewed stronger cipher policy instead.",
+        },
+        schema: [],
+        type: "problem",
+    },
+    name: "no-node-tls-security-level-zero",
+});
+export default rule;
+/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
+//# sourceMappingURL=no-node-tls-security-level-zero.js.map

package/dist/rules/no-node-tls-security-level-zero.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-tls-security-level-zero.js","sourceRoot":"","sources":["../../src/rules/no-node-tls-security-level-zero.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACH,eAAe,EACf,oBAAoB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACH,qBAAqB,EACrB,8BAA8B,GACjC,MAAM,iCAAiC,CAAC;AAIzC,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACxE,MAAM,+BAA+B,GAAG,uBAAuB,CAAC;AAEhE,MAAM,gBAAgB,GAAG,CAAC,IAAmB,EAA+B,EAAE,CAC1E,IAAI,CAAC,IAAI,KAAK,cAAc;IAC5B,IAAI,CAAC,IAAI,KAAK,mBAAmB;IACjC,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC;AAElC,MAAM,+BAA+B,GAAG,CAAC,KAAa,EAAW,EAAE,CAC/D,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEhD,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,OAAO;YACH,oBAAoB,CAAC,IAAmC;gBACpD,IACI,IAAI,CAAC,QAAQ,KAAK,GAAG;oBACrB,CAAC,qBAAqB,CAClB,IAAI,CAAC,IAAI,EACT,kCAAkC,CACrC,EACH,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAEzD,IACI,OAAO,eAAe,KAAK,QAAQ;oBACnC,CAAC,+BAA+B,CAAC,eAAe,CAAC,EACnD,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,IAAI,EAAE;wBACF,eAAe;wBACf,YAAY,EAAE,iBAAiB;qBAClC;oBACD,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,IAAI,CAAC,KAAK;iBACnB,CAAC,CAAC;YACP,CAAC;YACD,gBAAgB,CAAC,IAA+B;gBAC5C,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzC,IACI,YAAY,CAAC,IAAI,KAAK,UAAU;wBAChC,YAAY,CAAC,IAAI,KAAK,MAAM;wBAC5B,eAAe,CAAC,YAAY,CAAC,KAAK,SAAS;wBAC3C,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,EACvC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,eAAe,GAAG,oBAAoB,CACxC,YAAY,CAAC,KAAK,CACrB,CAAC;oBAEF,IACI,OAAO,eAAe,KAAK,QAAQ;wBACnC,CAAC,+BAA+B,CAAC,eAAe,CAAC,EACnD,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,eAAe;4BACf,YAAY,EAAE,SAAS;yBAC1B;wBACD,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,YAAY,CAAC,KAAK;qBAC3B,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,4EAA4E;YAChF,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,6FAA6F;SACrG;QACD,QAAQ,EAAE;YACN,OAAO,EACH,kKAAkK;SACzK;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,iCAAiC;CAC1C,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}

package/dist/rules/no-node-vm-run-in-context.d.ts

@@ -0,0 +1,5 @@
+import { createRule } from "../_internal/create-rule.js";
+/** Rule implementation. */
+declare const rule: ReturnType<typeof createRule>;
+export default rule;
+//# sourceMappingURL=no-node-vm-run-in-context.d.ts.map

package/dist/rules/no-node-vm-run-in-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-vm-run-in-context.d.ts","sourceRoot":"","sources":["../../src/rules/no-node-vm-run-in-context.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA6EzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA6LtC,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/dist/rules/no-node-vm-run-in-context.js

@@ -0,0 +1,186 @@
+import { isDefined, setHas } from "ts-extras";
+import { createRule } from "../_internal/create-rule.js";
+import { getMemberPropertyName, getPropertyName, } from "../_internal/estree-utils.js";
+const VM_MODULE_NAMES = new Set(["node:vm", "vm"]);
+const DISALLOWED_VM_CALL_NAMES = new Set([
+    "compileFunction",
+    "runInContext",
+    "runInNewContext",
+    "runInThisContext",
+]);
+const DISALLOWED_VM_CONSTRUCTOR_NAMES = new Set(["Script"]);
+const isVmModuleSource = (value) => setHas(VM_MODULE_NAMES, value);
+const isDisallowedVmCallName = (value) => isDefined(value) && setHas(DISALLOWED_VM_CALL_NAMES, value);
+const isDisallowedVmConstructorName = (value) => isDefined(value) && setHas(DISALLOWED_VM_CONSTRUCTOR_NAMES, value);
+const isRequireCallFromVmModule = (expression) => {
+    if (expression?.type !== "CallExpression" ||
+        expression.callee.type !== "Identifier" ||
+        expression.callee.name !== "require") {
+        return false;
+    }
+    const [firstArgument] = expression.arguments;
+    return (firstArgument !== undefined &&
+        firstArgument.type !== "SpreadElement" &&
+        firstArgument.type === "Literal" &&
+        typeof firstArgument.value === "string" &&
+        isVmModuleSource(firstArgument.value));
+};
+const getPatternIdentifier = (pattern) => {
+    if (pattern.type === "Identifier") {
+        return pattern;
+    }
+    if (pattern.type === "AssignmentPattern" &&
+        pattern.left.type === "Identifier") {
+        return pattern.left;
+    }
+    return undefined;
+};
+/** Rule implementation. */
+const rule = createRule({
+    create(context) {
+        const vmCallBindingNames = new Set();
+        const vmConstructorBindingNames = new Set();
+        const vmNamespaceBindingNames = new Set();
+        return {
+            CallExpression(node) {
+                if (node.callee.type === "Identifier") {
+                    if (!setHas(vmCallBindingNames, node.callee.name)) {
+                        return;
+                    }
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                    return;
+                }
+                if (node.callee.type !== "MemberExpression") {
+                    return;
+                }
+                const methodName = getMemberPropertyName(node.callee);
+                if (!isDisallowedVmCallName(methodName)) {
+                    return;
+                }
+                if (node.callee.object.type === "Identifier" &&
+                    setHas(vmNamespaceBindingNames, node.callee.object.name)) {
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                    return;
+                }
+                if (node.callee.object.type === "CallExpression" &&
+                    isRequireCallFromVmModule(node.callee.object)) {
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                }
+            },
+            ImportDeclaration(node) {
+                if (!isVmModuleSource(node.source.value)) {
+                    return;
+                }
+                for (const specifierNode of node.specifiers) {
+                    if (specifierNode.type === "ImportDefaultSpecifier" ||
+                        specifierNode.type === "ImportNamespaceSpecifier") {
+                        vmNamespaceBindingNames.add(specifierNode.local.name);
+                        continue;
+                    }
+                    const importedName = specifierNode.imported.type === "Identifier"
+                        ? specifierNode.imported.name
+                        : specifierNode.imported.value;
+                    if (isDisallowedVmCallName(importedName)) {
+                        vmCallBindingNames.add(specifierNode.local.name);
+                        continue;
+                    }
+                    if (isDisallowedVmConstructorName(importedName)) {
+                        vmConstructorBindingNames.add(specifierNode.local.name);
+                    }
+                }
+            },
+            NewExpression(node) {
+                if (node.callee.type === "Identifier") {
+                    if (!setHas(vmConstructorBindingNames, node.callee.name)) {
+                        return;
+                    }
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                    return;
+                }
+                if (node.callee.type !== "MemberExpression") {
+                    return;
+                }
+                const constructorName = getMemberPropertyName(node.callee);
+                if (!isDisallowedVmConstructorName(constructorName)) {
+                    return;
+                }
+                if (node.callee.object.type === "Identifier" &&
+                    setHas(vmNamespaceBindingNames, node.callee.object.name)) {
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                    return;
+                }
+                if (node.callee.object.type === "CallExpression" &&
+                    isRequireCallFromVmModule(node.callee.object)) {
+                    context.report({
+                        messageId: "default",
+                        node: node.callee,
+                    });
+                }
+            },
+            VariableDeclarator(node) {
+                if (!isRequireCallFromVmModule(node.init)) {
+                    return;
+                }
+                if (node.id.type === "Identifier") {
+                    vmNamespaceBindingNames.add(node.id.name);
+                    return;
+                }
+                if (node.id.type !== "ObjectPattern") {
+                    return;
+                }
+                for (const propertyNode of node.id.properties) {
+                    if (propertyNode.type !== "Property" ||
+                        propertyNode.computed) {
+                        continue;
+                    }
+                    const importedName = getPropertyName(propertyNode);
+                    const localIdentifier = getPatternIdentifier(propertyNode.value);
+                    if (localIdentifier === undefined) {
+                        continue;
+                    }
+                    if (isDisallowedVmCallName(importedName)) {
+                        vmCallBindingNames.add(localIdentifier.name);
+                        continue;
+                    }
+                    if (isDisallowedVmConstructorName(importedName)) {
+                        vmConstructorBindingNames.add(localIdentifier.name);
+                    }
+                }
+            },
+        };
+    },
+    defaultOptions: [],
+    meta: {
+        deprecated: false,
+        docs: {
+            description: "disallow node:vm dynamic code execution APIs that are commonly mistaken for a security sandbox.",
+            frozen: false,
+            recommended: false,
+            url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-node-vm-run-in-context",
+        },
+        messages: {
+            default: "Do not execute dynamic code through node:vm run/compile APIs; the vm module is not a security boundary.",
+        },
+        schema: [],
+        type: "problem",
+    },
+    name: "no-node-vm-run-in-context",
+});
+export default rule;
+/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
+//# sourceMappingURL=no-node-vm-run-in-context.js.map

package/dist/rules/no-node-vm-run-in-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-vm-run-in-context.js","sourceRoot":"","sources":["../../src/rules/no-node-vm-run-in-context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACH,qBAAqB,EACrB,eAAe,GAClB,MAAM,8BAA8B,CAAC;AAYtC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACnD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACrC,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;CACrB,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE5D,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAChD,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAEnC,MAAM,sBAAsB,GAAG,CAC3B,KAAyB,EACI,EAAE,CAC/B,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,6BAA6B,GAAG,CAClC,KAAyB,EACW,EAAE,CACtC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;AAEvE,MAAM,yBAAyB,GAAG,CAC9B,UAAsC,EACD,EAAE;IACvC,IACI,UAAU,EAAE,IAAI,KAAK,gBAAgB;QACrC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACvC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EACtC,CAAC;QACC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;IAE7C,OAAO,CACH,aAAa,KAAK,SAAS;QAC3B,aAAa,CAAC,IAAI,KAAK,eAAe;QACtC,aAAa,CAAC,IAAI,KAAK,SAAS;QAChC,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CACxC,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CACzB,OAAmC,EACJ,EAAE;IACjC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,IACI,OAAO,CAAC,IAAI,KAAK,mBAAmB;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EACpC,CAAC;QACC,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAU,CAAC;QACpD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;QAElD,OAAO;YACH,cAAc,CAAC,IAA6B;gBACxC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,OAAO;oBACX,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;oBAEH,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAEtD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtC,OAAO;gBACX,CAAC;gBAED,IACI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAC1D,CAAC;oBACC,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;oBAEH,OAAO;gBACX,CAAC;gBAED,IACI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;oBAC5C,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/C,CAAC;oBACC,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,iBAAiB,CAAC,IAAgC;gBAC9C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1C,IACI,aAAa,CAAC,IAAI,KAAK,wBAAwB;wBAC/C,aAAa,CAAC,IAAI,KAAK,0BAA0B,EACnD,CAAC;wBACC,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACtD,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GACd,aAAa,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACxC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI;wBAC7B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAEvC,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;wBACvC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjD,SAAS;oBACb,CAAC;oBAED,IAAI,6BAA6B,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC9C,yBAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5D,CAAC;gBACL,CAAC;YACL,CAAC;YACD,aAAa,CAAC,IAA4B;gBACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,OAAO;oBACX,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;oBAEH,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAE3D,IAAI,CAAC,6BAA6B,CAAC,eAAe,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACX,CAAC;gBAED,IACI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,MAAM,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAC1D,CAAC;oBACC,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;oBAEH,OAAO;gBACX,CAAC;gBAED,IACI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;oBAC5C,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/C,CAAC;oBACC,OAAO,CAAC,MAAM,CAAC;wBACX,SAAS,EAAE,SAAS;wBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,kBAAkB,CAAC,IAAiC;gBAChD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACnC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;oBAC5C,IACI,YAAY,CAAC,IAAI,KAAK,UAAU;wBAChC,YAAY,CAAC,QAAQ,EACvB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;oBACnD,MAAM,eAAe,GAAG,oBAAoB,CACxC,YAAY,CAAC,KAAK,CACrB,CAAC;oBAEF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;wBAChC,SAAS;oBACb,CAAC;oBAED,IAAI,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;wBACvC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;wBAC7C,SAAS;oBACb,CAAC;oBAED,IAAI,6BAA6B,CAAC,YAAY,CAAC,EAAE,CAAC;wBAC9C,yBAAyB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBACxD,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,iGAAiG;YACrG,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,uFAAuF;SAC/F;QACD,QAAQ,EAAE;YACN,OAAO,EACH,yGAAyG;SAChH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,2BAA2B;CACpC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}

package/dist/rules/no-node-vm-source-text-module.d.ts

@@ -0,0 +1,5 @@
+import { createRule } from "../_internal/create-rule.js";
+/** Rule implementation. */
+declare const rule: ReturnType<typeof createRule>;
+export default rule;
+//# sourceMappingURL=no-node-vm-source-text-module.d.ts.map

package/dist/rules/no-node-vm-source-text-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-vm-source-text-module.d.ts","sourceRoot":"","sources":["../../src/rules/no-node-vm-source-text-module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA8EzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA4GtC,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/dist/rules/no-node-vm-source-text-module.js

@@ -0,0 +1,126 @@
+import { setHas } from "ts-extras";
+import { createRule } from "../_internal/create-rule.js";
+import { getMemberPropertyName, getPropertyName, } from "../_internal/estree-utils.js";
+const VM_MODULE_NAMES = new Set(["node:vm", "vm"]);
+const SOURCE_TEXT_MODULE_NAME = "SourceTextModule";
+const isVmModuleSource = (value) => setHas(VM_MODULE_NAMES, value);
+const isRequireCallFromVmModule = (expression) => {
+    if (expression?.type !== "CallExpression" ||
+        expression.callee.type !== "Identifier" ||
+        expression.callee.name !== "require") {
+        return false;
+    }
+    const [firstArgument] = expression.arguments;
+    return (firstArgument !== undefined &&
+        firstArgument.type !== "SpreadElement" &&
+        firstArgument.type === "Literal" &&
+        typeof firstArgument.value === "string" &&
+        isVmModuleSource(firstArgument.value));
+};
+const getPatternIdentifier = (pattern) => {
+    if (pattern.type === "Identifier") {
+        return pattern;
+    }
+    if (pattern.type === "AssignmentPattern" &&
+        pattern.left.type === "Identifier") {
+        return pattern.left;
+    }
+    return undefined;
+};
+const isSourceTextModuleConstructor = (callee, sourceTextModuleBindingNames, vmNamespaceBindingNames) => {
+    if (callee.type === "Identifier") {
+        return setHas(sourceTextModuleBindingNames, callee.name);
+    }
+    if (callee.type !== "MemberExpression") {
+        return false;
+    }
+    if (getMemberPropertyName(callee) !== SOURCE_TEXT_MODULE_NAME) {
+        return false;
+    }
+    return ((callee.object.type === "Identifier" &&
+        setHas(vmNamespaceBindingNames, callee.object.name)) ||
+        (callee.object.type === "CallExpression" &&
+            isRequireCallFromVmModule(callee.object)));
+};
+/** Rule implementation. */
+const rule = createRule({
+    create(context) {
+        const sourceTextModuleBindingNames = new Set();
+        const vmNamespaceBindingNames = new Set();
+        return {
+            ImportDeclaration(node) {
+                if (!isVmModuleSource(node.source.value)) {
+                    return;
+                }
+                for (const specifierNode of node.specifiers) {
+                    if (specifierNode.type === "ImportDefaultSpecifier" ||
+                        specifierNode.type === "ImportNamespaceSpecifier") {
+                        vmNamespaceBindingNames.add(specifierNode.local.name);
+                        continue;
+                    }
+                    const importedName = specifierNode.imported.type === "Identifier"
+                        ? specifierNode.imported.name
+                        : specifierNode.imported.value;
+                    if (importedName === SOURCE_TEXT_MODULE_NAME) {
+                        sourceTextModuleBindingNames.add(specifierNode.local.name);
+                    }
+                }
+            },
+            NewExpression(node) {
+                if (!isSourceTextModuleConstructor(node.callee, sourceTextModuleBindingNames, vmNamespaceBindingNames)) {
+                    return;
+                }
+                context.report({
+                    messageId: "default",
+                    node: node.callee,
+                });
+            },
+            VariableDeclarator(node) {
+                if (!isRequireCallFromVmModule(node.init)) {
+                    return;
+                }
+                if (node.id.type === "Identifier") {
+                    vmNamespaceBindingNames.add(node.id.name);
+                    return;
+                }
+                if (node.id.type !== "ObjectPattern") {
+                    return;
+                }
+                for (const propertyNode of node.id.properties) {
+                    if (propertyNode.type !== "Property" ||
+                        propertyNode.computed) {
+                        continue;
+                    }
+                    if (getPropertyName(propertyNode) !==
+                        SOURCE_TEXT_MODULE_NAME) {
+                        continue;
+                    }
+                    const localIdentifier = getPatternIdentifier(propertyNode.value);
+                    if (localIdentifier === undefined) {
+                        continue;
+                    }
+                    sourceTextModuleBindingNames.add(localIdentifier.name);
+                }
+            },
+        };
+    },
+    defaultOptions: [],
+    meta: {
+        deprecated: false,
+        docs: {
+            description: "disallow node:vm SourceTextModule constructors that compile JavaScript source strings into executable modules.",
+            frozen: false,
+            recommended: false,
+            url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-node-vm-source-text-module",
+        },
+        messages: {
+            default: "Do not compile code with node:vm SourceTextModule; loading executable modules from source strings is not a security boundary.",
+        },
+        schema: [],
+        type: "problem",
+    },
+    name: "no-node-vm-source-text-module",
+});
+export default rule;
+/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
+//# sourceMappingURL=no-node-vm-source-text-module.js.map

package/dist/rules/no-node-vm-source-text-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-vm-source-text-module.js","sourceRoot":"","sources":["../../src/rules/no-node-vm-source-text-module.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACH,qBAAqB,EACrB,eAAe,GAClB,MAAM,8BAA8B,CAAC;AAItC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACnD,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAEnD,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAChD,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAEnC,MAAM,yBAAyB,GAAG,CAC9B,UAAsC,EACD,EAAE;IACvC,IACI,UAAU,EAAE,IAAI,KAAK,gBAAgB;QACrC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACvC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EACtC,CAAC;QACC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;IAE7C,OAAO,CACH,aAAa,KAAK,SAAS;QAC3B,aAAa,CAAC,IAAI,KAAK,eAAe;QACtC,aAAa,CAAC,IAAI,KAAK,SAAS;QAChC,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CACxC,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CACzB,OAAmC,EACJ,EAAE;IACjC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,IACI,OAAO,CAAC,IAAI,KAAK,mBAAmB;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EACpC,CAAC;QACC,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CAClC,MAAkD,EAClD,4BAAiD,EACjD,uBAA4C,EACrC,EAAE;IACT,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,uBAAuB,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,CACH,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QAChC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;YACpC,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;AACN,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAU,CAAC;QACvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;QAElD,OAAO;YACH,iBAAiB,CAAC,IAAgC;gBAC9C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1C,IACI,aAAa,CAAC,IAAI,KAAK,wBAAwB;wBAC/C,aAAa,CAAC,IAAI,KAAK,0BAA0B,EACnD,CAAC;wBACC,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACtD,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GACd,aAAa,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACxC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI;wBAC7B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAEvC,IAAI,YAAY,KAAK,uBAAuB,EAAE,CAAC;wBAC3C,4BAA4B,CAAC,GAAG,CAC5B,aAAa,CAAC,KAAK,CAAC,IAAI,CAC3B,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YACD,aAAa,CAAC,IAA4B;gBACtC,IACI,CAAC,6BAA6B,CAC1B,IAAI,CAAC,MAAM,EACX,4BAA4B,EAC5B,uBAAuB,CAC1B,EACH,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACP,CAAC;YACD,kBAAkB,CAAC,IAAiC;gBAChD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACnC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;oBAC5C,IACI,YAAY,CAAC,IAAI,KAAK,UAAU;wBAChC,YAAY,CAAC,QAAQ,EACvB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,IACI,eAAe,CAAC,YAAY,CAAC;wBAC7B,uBAAuB,EACzB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,eAAe,GAAG,oBAAoB,CACxC,YAAY,CAAC,KAAK,CACrB,CAAC;oBAEF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;wBAChC,SAAS;oBACb,CAAC;oBAED,4BAA4B,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAC3D,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,gHAAgH;YACpH,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,2FAA2F;SACnG;QACD,QAAQ,EAAE;YACN,OAAO,EACH,+HAA+H;SACtI;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,+BAA+B;CACxC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}

package/dist/rules/no-node-worker-threads-eval.d.ts

@@ -0,0 +1,5 @@
+import { createRule } from "../_internal/create-rule.js";
+/** Rule implementation. */
+declare const rule: ReturnType<typeof createRule>;
+export default rule;
+//# sourceMappingURL=no-node-worker-threads-eval.d.ts.map

package/dist/rules/no-node-worker-threads-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-worker-threads-eval.d.ts","sourceRoot":"","sources":["../../src/rules/no-node-worker-threads-eval.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA2GzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAmHtC,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/dist/rules/no-node-worker-threads-eval.js

@@ -0,0 +1,151 @@
+import { setHas } from "ts-extras";
+import { createRule } from "../_internal/create-rule.js";
+import { getMemberPropertyName, getPropertyName, } from "../_internal/estree-utils.js";
+const WORKER_THREADS_MODULE_NAMES = new Set([
+    "node:worker_threads",
+    "worker_threads",
+]);
+const isWorkerThreadsModuleSource = (value) => setHas(WORKER_THREADS_MODULE_NAMES, value);
+const isRequireCallFromWorkerThreads = (expression) => {
+    if (expression?.type !== "CallExpression" ||
+        expression.callee.type !== "Identifier" ||
+        expression.callee.name !== "require") {
+        return false;
+    }
+    const [firstArgument] = expression.arguments;
+    return (firstArgument !== undefined &&
+        firstArgument.type !== "SpreadElement" &&
+        firstArgument.type === "Literal" &&
+        typeof firstArgument.value === "string" &&
+        isWorkerThreadsModuleSource(firstArgument.value));
+};
+const getPatternIdentifier = (pattern) => {
+    if (pattern.type === "Identifier") {
+        return pattern;
+    }
+    if (pattern.type === "AssignmentPattern" &&
+        pattern.left.type === "Identifier") {
+        return pattern.left;
+    }
+    return undefined;
+};
+const hasEvalTrueOption = (optionsNode) => {
+    if (optionsNode.type !== "ObjectExpression") {
+        return false;
+    }
+    for (const propertyNode of optionsNode.properties) {
+        if (propertyNode.type !== "Property" || propertyNode.kind !== "init") {
+            continue;
+        }
+        if (getPropertyName(propertyNode) !== "eval") {
+            continue;
+        }
+        if (propertyNode.value.type === "Literal" &&
+            propertyNode.value.value === true) {
+            return true;
+        }
+    }
+    return false;
+};
+const isWorkerThreadsWorkerConstructor = (callee, workerBindingNames, workerThreadsNamespaceBindingNames) => {
+    if (callee.type === "Identifier") {
+        return setHas(workerBindingNames, callee.name);
+    }
+    if (callee.type !== "MemberExpression") {
+        return false;
+    }
+    if (getMemberPropertyName(callee) !== "Worker") {
+        return false;
+    }
+    return ((callee.object.type === "Identifier" &&
+        setHas(workerThreadsNamespaceBindingNames, callee.object.name)) ||
+        (callee.object.type === "CallExpression" &&
+            isRequireCallFromWorkerThreads(callee.object)));
+};
+/** Rule implementation. */
+const rule = createRule({
+    create(context) {
+        const workerBindingNames = new Set();
+        const workerThreadsNamespaceBindingNames = new Set();
+        return {
+            ImportDeclaration(node) {
+                if (!isWorkerThreadsModuleSource(node.source.value)) {
+                    return;
+                }
+                for (const specifierNode of node.specifiers) {
+                    if (specifierNode.type === "ImportDefaultSpecifier" ||
+                        specifierNode.type === "ImportNamespaceSpecifier") {
+                        workerThreadsNamespaceBindingNames.add(specifierNode.local.name);
+                        continue;
+                    }
+                    const importedName = specifierNode.imported.type === "Identifier"
+                        ? specifierNode.imported.name
+                        : specifierNode.imported.value;
+                    if (importedName === "Worker") {
+                        workerBindingNames.add(specifierNode.local.name);
+                    }
+                }
+            },
+            NewExpression(node) {
+                if (!isWorkerThreadsWorkerConstructor(node.callee, workerBindingNames, workerThreadsNamespaceBindingNames)) {
+                    return;
+                }
+                const [, secondArgument] = node.arguments;
+                if (secondArgument === undefined ||
+                    secondArgument.type === "SpreadElement" ||
+                    !hasEvalTrueOption(secondArgument)) {
+                    return;
+                }
+                context.report({
+                    messageId: "default",
+                    node: secondArgument,
+                });
+            },
+            VariableDeclarator(node) {
+                if (!isRequireCallFromWorkerThreads(node.init)) {
+                    return;
+                }
+                if (node.id.type === "Identifier") {
+                    workerThreadsNamespaceBindingNames.add(node.id.name);
+                    return;
+                }
+                if (node.id.type !== "ObjectPattern") {
+                    return;
+                }
+                for (const propertyNode of node.id.properties) {
+                    if (propertyNode.type !== "Property" ||
+                        propertyNode.computed) {
+                        continue;
+                    }
+                    if (getPropertyName(propertyNode) !== "Worker") {
+                        continue;
+                    }
+                    const localIdentifier = getPatternIdentifier(propertyNode.value);
+                    if (localIdentifier === undefined) {
+                        continue;
+                    }
+                    workerBindingNames.add(localIdentifier.name);
+                }
+            },
+        };
+    },
+    defaultOptions: [],
+    meta: {
+        deprecated: false,
+        docs: {
+            description: "disallow node:worker_threads Worker options that enable eval: true string execution.",
+            frozen: false,
+            recommended: false,
+            url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-node-worker-threads-eval",
+        },
+        messages: {
+            default: "Do not enable eval: true for node:worker_threads Worker instances; prefer reviewed worker script files instead of string-backed execution.",
+        },
+        schema: [],
+        type: "problem",
+    },
+    name: "no-node-worker-threads-eval",
+});
+export default rule;
+/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
+//# sourceMappingURL=no-node-worker-threads-eval.js.map

package/dist/rules/no-node-worker-threads-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-worker-threads-eval.js","sourceRoot":"","sources":["../../src/rules/no-node-worker-threads-eval.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EACH,qBAAqB,EACrB,eAAe,GAClB,MAAM,8BAA8B,CAAC;AAItC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IACxC,qBAAqB;IACrB,gBAAgB;CACnB,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,KAAa,EAAW,EAAE,CAC3D,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;AAE/C,MAAM,8BAA8B,GAAG,CACnC,UAAsC,EACD,EAAE;IACvC,IACI,UAAU,EAAE,IAAI,KAAK,gBAAgB;QACrC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACvC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EACtC,CAAC;QACC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;IAE7C,OAAO,CACH,aAAa,KAAK,SAAS;QAC3B,aAAa,CAAC,IAAI,KAAK,eAAe;QACtC,aAAa,CAAC,IAAI,KAAK,SAAS;QAChC,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,2BAA2B,CAAC,aAAa,CAAC,KAAK,CAAC,CACnD,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CACzB,OAAmC,EACJ,EAAE;IACjC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,IACI,OAAO,CAAC,IAAI,KAAK,mBAAmB;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EACpC,CAAC;QACC,OAAO,OAAO,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACtB,WAA0C,EACnC,EAAE;IACT,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnE,SAAS;QACb,CAAC;QAED,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3C,SAAS;QACb,CAAC;QAED,IACI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YACrC,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EACnC,CAAC;YACC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CACrC,MAAkD,EAClD,kBAAuC,EACvC,kCAAuD,EAChD,EAAE;IACT,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,CACH,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QAChC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;YACpC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACrD,CAAC;AACN,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,kCAAkC,GAAG,IAAI,GAAG,EAAU,CAAC;QAE7D,OAAO;YACH,iBAAiB,CAAC,IAAgC;gBAC9C,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1C,IACI,aAAa,CAAC,IAAI,KAAK,wBAAwB;wBAC/C,aAAa,CAAC,IAAI,KAAK,0BAA0B,EACnD,CAAC;wBACC,kCAAkC,CAAC,GAAG,CAClC,aAAa,CAAC,KAAK,CAAC,IAAI,CAC3B,CAAC;wBACF,SAAS;oBACb,CAAC;oBAED,MAAM,YAAY,GACd,aAAa,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACxC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI;wBAC7B,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAEvC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;wBAC5B,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrD,CAAC;gBACL,CAAC;YACL,CAAC;YACD,aAAa,CAAC,IAA4B;gBACtC,IACI,CAAC,gCAAgC,CAC7B,IAAI,CAAC,MAAM,EACX,kBAAkB,EAClB,kCAAkC,CACrC,EACH,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAE1C,IACI,cAAc,KAAK,SAAS;oBAC5B,cAAc,CAAC,IAAI,KAAK,eAAe;oBACvC,CAAC,iBAAiB,CAAC,cAAc,CAAC,EACpC,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI,EAAE,cAAc;iBACvB,CAAC,CAAC;YACP,CAAC;YACD,kBAAkB,CAAC,IAAiC;gBAChD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBACrD,OAAO;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACnC,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;oBAC5C,IACI,YAAY,CAAC,IAAI,KAAK,UAAU;wBAChC,YAAY,CAAC,QAAQ,EACvB,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC7C,SAAS;oBACb,CAAC;oBAED,MAAM,eAAe,GAAG,oBAAoB,CACxC,YAAY,CAAC,KAAK,CACrB,CAAC;oBAEF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;wBAChC,SAAS;oBACb,CAAC;oBAED,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBACjD,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,sFAAsF;YAC1F,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,yFAAyF;SACjG;QACD,QAAQ,EAAE;YACN,OAAO,EACH,4IAA4I;SACnJ;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,6BAA6B;CACtC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}

package/dist/rules/no-nonnull-assertion-on-security-input.d.ts

@@ -0,0 +1,5 @@
+import { createRule } from "../_internal/create-rule.js";
+/** Rule implementation. */
+declare const rule: ReturnType<typeof createRule>;
+export default rule;
+//# sourceMappingURL=no-nonnull-assertion-on-security-input.d.ts.map

package/dist/rules/no-nonnull-assertion-on-security-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-nonnull-assertion-on-security-input.d.ts","sourceRoot":"","sources":["../../src/rules/no-nonnull-assertion-on-security-input.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwBzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAiCtC,CAAC;AAEH,eAAe,IAAI,CAAC"}