eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-clickjacking.js

@@ -0,0 +1,381 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noClickjacking = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const eslint_devkit_3 = require("@interlace/eslint-devkit");
+exports.noClickjacking = (0, eslint_devkit_1.createRule)({
+    name: 'no-clickjacking',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects clickjacking vulnerabilities and missing frame protections',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            clickjackingVulnerability: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Clickjacking Vulnerability',
+                cwe: 'CWE-1021',
+                description: 'Clickjacking protection missing',
+                severity: '{{severity}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            missingFrameBusting: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Missing Frame Busting',
+                cwe: 'CWE-1021',
+                description: 'No frame-busting code to prevent clickjacking',
+                severity: 'HIGH',
+                fix: 'Add frame-busting JavaScript to prevent framing',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            unsafeIframeUsage: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe iframe Usage',
+                cwe: 'CWE-1021',
+                description: 'iframe may enable clickjacking attacks',
+                severity: 'MEDIUM',
+                fix: 'Add X-Frame-Options or CSP frame-ancestors protection',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            missingXFrameOptions: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Missing X-Frame-Options',
+                cwe: 'CWE-1021',
+                description: 'X-Frame-Options header not set',
+                severity: 'HIGH',
+                fix: 'Set X-Frame-Options: DENY or SAMEORIGIN',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options',
+            }),
+            missingCspFrameAncestors: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Missing CSP frame-ancestors',
+                cwe: 'CWE-1021',
+                description: 'CSP frame-ancestors directive not configured',
+                severity: 'HIGH',
+                fix: 'Add frame-ancestors to Content-Security-Policy',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors',
+            }),
+            transparentFrameOverlay: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Transparent Frame Overlay',
+                cwe: 'CWE-1021',
+                description: 'Transparent elements may hide clickjacking attacks',
+                severity: 'MEDIUM',
+                fix: 'Use frame-busting or CSP protections',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            frameManipulation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Frame Manipulation',
+                cwe: 'CWE-1021',
+                description: 'Code attempts to manipulate parent frames',
+                severity: 'LOW',
+                fix: 'Implement proper frame communication or prevent framing',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            implementFrameBusting: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Implement Frame Busting',
+                description: 'Add JavaScript to prevent framing',
+                severity: 'LOW',
+                fix: 'if (top != self) top.location = location;',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            useXFrameOptions: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use X-Frame-Options',
+                description: 'Set X-Frame-Options HTTP header',
+                severity: 'LOW',
+                fix: 'X-Frame-Options: DENY',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options',
+            }),
+            setCspFrameAncestors: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Set CSP frame-ancestors',
+                description: 'Configure CSP frame-ancestors directive',
+                severity: 'LOW',
+                fix: 'frame-ancestors \'self\' https://trusted.com',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors',
+            }),
+            strategyFrameProtection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Frame Protection Strategy',
+                description: 'Implement multiple layers of frame protection',
+                severity: 'LOW',
+                fix: 'Use X-Frame-Options, CSP, and frame-busting together',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            }),
+            strategyContentSecurity: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Content Security Strategy',
+                description: 'Use CSP for comprehensive frame control',
+                severity: 'LOW',
+                fix: 'Implement strict CSP with frame-ancestors',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP',
+            }),
+            strategyUserInteraction: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'User Interaction Strategy',
+                description: 'Protect user interactions from framing attacks',
+                severity: 'LOW',
+                fix: 'Validate user intent for sensitive actions',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    trustedSources: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['self', 'same-origin'],
+                    },
+                    requireFrameBusting: {
+                        type: 'boolean',
+                        default: true,
+                    },
+                    detectTransparentOverlays: {
+                        type: 'boolean',
+                        default: true,
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional function names to consider as frame protectors',
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional JSDoc annotations to consider as safe markers',
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Disable all false positive detection (strict mode)',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            trustedSources: ['self', 'same-origin'],
+            requireFrameBusting: true,
+            detectTransparentOverlays: true,
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { trustedSources = ['self', 'same-origin'], requireFrameBusting = true, detectTransparentOverlays = true, trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
+        const sourceCode = context.sourceCode || context.sourceCode;
+        const filename = context.filename || context.getFilename();
+        // Create safety checker for false positive detection
+        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
+            trustedSanitizers,
+            trustedAnnotations,
+            trustedOrmPatterns: [],
+            strictMode,
+        });
+        // Track if frame-busting code is present
+        let hasFrameBusting = false;
+        /**
+         * Check if source is trusted
+         */
+        const isTrustedSource = (source) => {
+            return trustedSources.some(trusted => source.includes(trusted) ||
+                (trusted === 'self' && (source === 'self' || source.startsWith('/'))) ||
+                (trusted === 'same-origin' && source === 'same-origin'));
+        };
+        /**
+         * Check if this is frame-busting code
+         */
+        const isFrameBustingCode = (node) => {
+            const test = node.test;
+            const testText = sourceCode.getText(test).toLowerCase();
+            // Look for common frame-busting patterns
+            return testText.includes('top != self') ||
+                testText.includes('top !== self') ||
+                testText.includes('window.top !== window.self') ||
+                testText.includes('parent != self') ||
+                testText.includes('top.location') ||
+                testText.includes('self.location');
+        };
+        /**
+         * Check for transparent/invisible elements that could hide clickjacking
+         */
+        const hasTransparentStyles = (styleText) => {
+            const styles = styleText.toLowerCase();
+            return styles.includes('opacity: 0') ||
+                styles.includes('opacity:0') ||
+                styles.includes('visibility: hidden') ||
+                styles.includes('display: none') ||
+                styles.includes('z-index: -1') ||
+                styles.includes('position: absolute') && styles.includes('top: 0') && styles.includes('left: 0');
+        };
+        return {
+            // Check for frame-busting code
+            IfStatement(node) {
+                if (isFrameBustingCode(node)) {
+                    hasFrameBusting = true;
+                }
+            },
+            // Check iframe elements (in JSX/TSX)
+            JSXElement(node) {
+                if (node.openingElement.name.type === 'JSXIdentifier' &&
+                    node.openingElement.name.name === 'iframe') {
+                    // Check iframe attributes
+                    const attributes = node.openingElement.attributes;
+                    let hasSrc = false;
+                    let srcValue = '';
+                    for (const attr of attributes) {
+                        if (attr.type === 'JSXAttribute' &&
+                            attr.name.type === 'JSXIdentifier' &&
+                            attr.name.name === 'src' &&
+                            attr.value) {
+                            hasSrc = true;
+                            if (attr.value.type === 'Literal' && typeof attr.value.value === 'string') {
+                                srcValue = attr.value.value;
+                            }
+                        }
+                    }
+                    if (hasSrc && srcValue && !isTrustedSource(srcValue)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node, context)) {
+                            return;
+                        }
+                        context.report({
+                            node: node.openingElement,
+                            messageId: 'unsafeIframeUsage',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+            },
+            // Check for frame manipulation code
+            MemberExpression(node) {
+                // Look for top.location or window.top manipulation
+                if (node.object.type === 'Identifier' &&
+                    (node.object.name === 'top' || node.object.name === 'window')) {
+                    if (node.property.type === 'Identifier' &&
+                        (node.property.name === 'location' || node.property.name === 'top')) {
+                        // Check if this is being assigned or compared
+                        let current = node;
+                        let isFrameManipulation = false;
+                        // Walk up to see if this is an assignment or comparison
+                        while (current && !isFrameManipulation) {
+                            if (current.type === 'AssignmentExpression' &&
+                                current.left === node) {
+                                isFrameManipulation = true;
+                                break;
+                            }
+                            if (current.type === 'BinaryExpression' &&
+                                (current.left === node || current.right === node)) {
+                                // Comparison like top != self
+                                const operator = current.operator;
+                                if (operator === '!=' || operator === '!==' ||
+                                    operator === '==' || operator === '===') {
+                                    // This might be frame-busting code
+                                    break;
+                                }
+                                isFrameManipulation = true;
+                                break;
+                            }
+                            current = current.parent;
+                        }
+                        if (isFrameManipulation) {
+                            // FALSE POSITIVE REDUCTION
+                            if (safetyChecker.isSafe(node, context)) {
+                                return;
+                            }
+                            context.report({
+                                node,
+                                messageId: 'frameManipulation',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                            });
+                        }
+                    }
+                }
+            },
+            // Check for CSS that could hide clickjacking attacks
+            Literal(node) {
+                if (typeof node.value === 'string' && detectTransparentOverlays) {
+                    // Check if this looks like CSS
+                    const text = node.value.toLowerCase();
+                    if ((text.includes('style=') || text.includes('css')) &&
+                        hasTransparentStyles(text)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node, context)) {
+                            return;
+                        }
+                        context.report({
+                            node,
+                            messageId: 'transparentFrameOverlay',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+            },
+            // Check template literals for CSS
+            TemplateLiteral(node) {
+                if (detectTransparentOverlays) {
+                    const text = sourceCode.getText(node).toLowerCase();
+                    if (text.includes('style') && hasTransparentStyles(text)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node, context)) {
+                            return;
+                        }
+                        context.report({
+                            node,
+                            messageId: 'transparentFrameOverlay',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+            },
+            // At the end of the file, check if frame-busting is required but missing
+            'Program:exit'() {
+                if (requireFrameBusting && !hasFrameBusting) {
+                    // Check if this file likely needs frame protection (has UI elements)
+                    const fileContent = sourceCode.getText();
+                    const hasUIElements = /\b(button|input|form|a|div)\b/i.test(fileContent) ||
+                        fileContent.includes('onClick') ||
+                        fileContent.includes('onSubmit');
+                    if (hasUIElements) {
+                        context.report({
+                            node: context.sourceCode.ast,
+                            messageId: 'missingFrameBusting',
+                            data: {
+                                filePath: filename,
+                                line: '1',
+                            },
+                        });
+                    }
+                }
+            }
+        };
+    },
+});
+//# sourceMappingURL=no-clickjacking.js.map

package/src/rules/security/no-clickjacking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-clickjacking.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-clickjacking.ts"],"names":[],"mappings":";;;AAgBA,4DAAsD;AACtD,4DAA0E;AAC1E,4DAGkC;AA8BrB,QAAA,cAAc,GAAG,IAAA,0BAAU,EAA0B;IAChE,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,oEAAoE;SAClF;QACD,OAAO,EAAE,MAAM;QACf,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,yBAAyB,EAAE,IAAA,gCAAgB,EAAC;gBAC1C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,4BAA4B;gBACvC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qBAAqB;gBAChC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,wCAAwC;gBACrD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,yBAAyB;gBACpC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,yCAAyC;gBAC9C,iBAAiB,EAAE,2EAA2E;aAC/F,CAAC;YACF,wBAAwB,EAAE,IAAA,gCAAgB,EAAC;gBACzC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,mGAAmG;aACvH,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,oDAAoD;gBACjE,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,sCAAsC;gBAC3C,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,yDAAyD;gBAC9D,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,mCAAmC;gBAChD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2CAA2C;gBAChD,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uBAAuB;gBAC5B,iBAAiB,EAAE,2EAA2E;aAC/F,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,8CAA8C;gBACnD,iBAAiB,EAAE,mGAAmG;aACvH,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,sDAAsD;gBAC3D,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2CAA2C;gBAChD,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,gDAAgD;gBAC7D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,4CAA4C;gBACjD,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;qBACjC;oBACD,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;oBACD,yBAAyB,EAAE;wBACzB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,2DAA2D;qBACzE;oBACD,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,0DAA0D;qBACxE;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,cAAc,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;YACvC,mBAAmB,EAAE,IAAI;YACzB,yBAAyB,EAAE,IAAI;YAC/B,iBAAiB,EAAE,EAAE;YACrB,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;SAClB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,cAAc,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACxC,mBAAmB,GAAG,IAAI,EAC1B,yBAAyB,GAAG,IAAI,EAChC,iBAAiB,GAAG,EAAE,EACtB,kBAAkB,GAAG,EAAE,EACvB,UAAU,GAAG,KAAK,GACnB,GAAY,OAAO,CAAC;QAErB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3D,qDAAqD;QACrD,MAAM,aAAa,GAAG,IAAA,mCAAmB,EAAC;YACxC,iBAAiB;YACjB,kBAAkB;YAClB,kBAAkB,EAAE,EAAE;YACtB,UAAU;SACX,CAAC,CAAC;QAEH,yCAAyC;QACzC,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAW,EAAE;YAClD,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACnC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACxB,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrE,CAAC,OAAO,KAAK,aAAa,IAAI,MAAM,KAAK,aAAa,CAAC,CACxD,CAAC;QACJ,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAA0B,EAAW,EAAE;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAExD,yCAAyC;YACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAC/C,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAW,EAAE;YAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC7B,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC5B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBACrC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAChC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC9B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC,CAAC;QAEF,OAAO;YACL,+BAA+B;YAC/B,WAAW,CAAC,IAA0B;gBACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,UAAU,CAAC,IAAyB;gBAClC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;oBACjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAE/C,0BAA0B;oBAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClD,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,QAAQ,GAAG,EAAE,CAAC;oBAElB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;wBAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;4BAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;4BAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK;4BACxB,IAAI,CAAC,KAAK,EAAE,CAAC;4BAEf,MAAM,GAAG,IAAI,CAAC;4BACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCAC1E,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;4BAC9B,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,IAAI,MAAM,IAAI,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACrD,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACxC,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,IAAI,CAAC,cAAc;4BACzB,SAAS,EAAE,mBAAmB;4BAC9B,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,gBAAgB,CAAC,IAA+B;gBAC9C,mDAAmD;gBACnD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACjC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAElE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACnC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;wBAExE,8CAA8C;wBAC9C,IAAI,OAAO,GAA8B,IAAI,CAAC;wBAC9C,IAAI,mBAAmB,GAAG,KAAK,CAAC;wBAEhC,wDAAwD;wBACxD,OAAO,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;4BACvC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB;gCACvC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gCAC1B,mBAAmB,GAAG,IAAI,CAAC;gCAC3B,MAAM;4BACR,CAAC;4BACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB;gCACnC,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;gCACtD,8BAA8B;gCAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gCAClC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK;oCACvC,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;oCAC5C,mCAAmC;oCACnC,MAAM;gCACR,CAAC;gCACD,mBAAmB,GAAG,IAAI,CAAC;gCAC3B,MAAM;4BACR,CAAC;4BACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;wBAC5C,CAAC;wBAED,IAAI,mBAAmB,EAAE,CAAC;4BACxB,2BAA2B;4BAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCACxC,OAAO;4BACT,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI;gCACJ,SAAS,EAAE,mBAAmB;gCAC9B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,OAAO,CAAC,IAAsB;gBAC5B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,yBAAyB,EAAE,CAAC;oBAChE,+BAA+B;oBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBACjD,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAE/B,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACxC,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,yBAAyB;4BACpC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,eAAe,CAAC,IAA8B;gBAC5C,IAAI,yBAAyB,EAAE,CAAC;oBAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;oBAEpD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzD,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACxC,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,yBAAyB;4BACpC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,cAAc;gBACZ,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC5C,qEAAqE;oBACrE,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,gCAAgC,CAAC,IAAI,CAAC,WAAW,CAAC;wBACnD,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC/B,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAEtD,IAAI,aAAa,EAAE,CAAC;wBAClB,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;4BAC5B,SAAS,EAAE,qBAAqB;4BAChC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,GAAG;6BACV;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-directive-injection.d.ts

@@ -0,0 +1,12 @@
+import { type SecurityRuleOptions } from '@interlace/eslint-devkit';
+export interface Options extends SecurityRuleOptions {
+    /** Trusted directive/component names */
+    trustedDirectives?: string[];
+    /** Variables that contain user input */
+    userInputVariables?: string[];
+    /** Frameworks to check for */
+    frameworks?: string[];
+    /** Allow dynamic directives in specific contexts */
+    allowDynamicInComponents?: boolean;
+}
+export declare const noDirectiveInjection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;