eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-improper-sanitization.js

@@ -0,0 +1,408 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noImproperSanitization = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const eslint_devkit_3 = require("@interlace/eslint-devkit");
+exports.noImproperSanitization = (0, eslint_devkit_1.createRule)({
+    name: 'no-improper-sanitization',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects improper sanitization of user input',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            improperSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Improper Sanitization',
+                cwe: 'CWE-116',
+                description: 'User input sanitization is insufficient or incorrect',
+                severity: '{{severity}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/116.html',
+            }),
+            insufficientXssProtection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Insufficient XSS Protection',
+                cwe: 'CWE-79',
+                description: 'XSS protection is incomplete or missing',
+                severity: 'HIGH',
+                fix: 'Use comprehensive XSS prevention or trusted sanitization library',
+                documentationLink: 'https://owasp.org/www-community/attacks/xss/',
+            }),
+            incompleteHtmlEscaping: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Incomplete HTML Escaping',
+                cwe: 'CWE-116',
+                description: 'HTML escaping misses dangerous characters',
+                severity: 'MEDIUM',
+                fix: 'Escape all HTML special characters: & < > " \'',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html',
+            }),
+            unsafeReplaceSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe Replace Sanitization',
+                cwe: 'CWE-116',
+                description: 'Simple replace() calls are insufficient for sanitization',
+                severity: 'MEDIUM',
+                fix: 'Use comprehensive sanitization libraries',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/116.html',
+            }),
+            missingContextEncoding: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Missing Context Encoding',
+                cwe: 'CWE-116',
+                description: 'Output encoding missing for specific context',
+                severity: 'MEDIUM',
+                fix: 'Encode output according to usage context (HTML, URL, SQL, etc.)',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html',
+            }),
+            dangerousSanitizerUsage: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Dangerous Sanitizer Usage',
+                cwe: 'CWE-94',
+                description: 'Custom sanitizer may be incomplete or bypassable',
+                severity: 'LOW',
+                fix: 'Use well-tested sanitization libraries',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/94.html',
+            }),
+            sqlInjectionSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'SQL Injection Sanitization',
+                cwe: 'CWE-89',
+                description: 'SQL input sanitization is insufficient',
+                severity: 'HIGH',
+                fix: 'Use parameterized queries instead of sanitization',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            }),
+            commandInjectionSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Command Injection Sanitization',
+                cwe: 'CWE-78',
+                description: 'Command input sanitization is insufficient',
+                severity: 'CRITICAL',
+                fix: 'Avoid shell commands with user input, use safe APIs',
+                documentationLink: 'https://owasp.org/www-community/attacks/Command_Injection',
+            }),
+            useProperSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use Proper Sanitization',
+                description: 'Use proper sanitization methods for each context',
+                severity: 'LOW',
+                fix: 'HTML: DOMPurify, URL: encodeURIComponent, SQL: parameterized queries',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
+            }),
+            validateSanitization: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Validate Sanitization',
+                description: 'Validate that sanitization is effective',
+                severity: 'LOW',
+                fix: 'Test sanitization with malicious inputs',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/116.html',
+            }),
+            implementContextAware: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Implement Context Aware Sanitization',
+                description: 'Use different sanitization for different contexts',
+                severity: 'LOW',
+                fix: 'HTML context: escape <>&"\' , URL context: encodeURIComponent',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html',
+            }),
+            strategyDefenseInDepth: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Defense in Depth Strategy',
+                description: 'Implement multiple layers of input validation',
+                severity: 'LOW',
+                fix: 'Validate input, sanitize output, use CSP, implement rate limiting',
+                documentationLink: 'https://owasp.org/www-community/controls/Defense_in_depth',
+            }),
+            strategyInputValidation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Input Validation Strategy',
+                description: 'Validate input at multiple layers',
+                severity: 'LOW',
+                fix: 'Client-side, server-side, and database-level validation',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html',
+            }),
+            strategyOutputEncoding: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Output Encoding Strategy',
+                description: 'Encode output according to context',
+                severity: 'LOW',
+                fix: 'Use appropriate encoding for HTML, JavaScript, CSS, URL contexts',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    safeSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['DOMPurify.sanitize', 'he.encode', 'encodeURIComponent', 'encodeURI', 'escape'],
+                    },
+                    dangerousChars: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['<', '>', '"', "'", '&', '`', '$', '{', '}', '|', ';', '(', ')'],
+                    },
+                    contexts: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['html', 'url', 'sql', 'command', 'javascript', 'css'],
+                    },
+                    trustedLibraries: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['DOMPurify', 'he', 'validator', 'express-validator'],
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional function names to consider as sanitizers',
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional JSDoc annotations to consider as safe markers',
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Disable all false positive detection (strict mode)',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            safeSanitizers: ['DOMPurify.sanitize', 'he.encode', 'encodeURIComponent', 'encodeURI', 'escape'],
+            dangerousChars: ['<', '>', '"', "'", '&', '`', '$', '{', '}', '|', ';', '(', ')'],
+            contexts: ['html', 'url', 'sql', 'command', 'javascript', 'css'],
+            trustedLibraries: ['DOMPurify', 'he', 'validator', 'express-validator'],
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { safeSanitizers = ['DOMPurify.sanitize', 'he.encode', 'encodeURIComponent', 'encodeURI', 'escape'], dangerousChars = ['<', '>', '"', "'", '&', '`', '$', '{', '}', '|', ';', '(', ')'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
+        const sourceCode = context.sourceCode || context.sourceCode;
+        const filename = context.filename || context.getFilename();
+        // Create safety checker for false positive detection
+        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
+            trustedSanitizers,
+            trustedAnnotations,
+            trustedOrmPatterns: [],
+            strictMode,
+        });
+        /**
+         * Check if sanitization is safe
+         */
+        const isSafeSanitizer = (callText) => {
+            return safeSanitizers.some(sanitizer => callText.includes(sanitizer));
+        };
+        /**
+         * Check if replace sanitization is incomplete
+         */
+        const isIncompleteReplaceSanitization = (callExpression) => {
+            const callText = sourceCode.getText(callExpression);
+            // Check for incomplete HTML escaping
+            if (callText.includes('replace(/</g, "&lt;")') ||
+                callText.includes('replace(/>/g, "&gt;")')) {
+                // If only escaping < and > but not other dangerous chars, it's incomplete
+                const hasQuoteEscaping = callText.includes('&quot;') || callText.includes('&#x27;');
+                const hasAmpersandEscaping = callText.includes('&amp;');
+                return !(hasQuoteEscaping && hasAmpersandEscaping);
+            }
+            return false;
+        };
+        /**
+         * Check if output context suggests needed encoding
+         */
+        const needsContextEncoding = (outputNode) => {
+            let current = outputNode;
+            // Look for context clues in surrounding code
+            while (current) {
+                const text = sourceCode.getText(current).toLowerCase();
+                if (text.includes('innerhtml') || text.includes('outerhtml')) {
+                    return 'html';
+                }
+                if (text.includes('href') || text.includes('src') || text.includes('url')) {
+                    return 'url';
+                }
+                if (text.includes('sql') || text.includes('query') || text.includes('execute')) {
+                    return 'sql';
+                }
+                if (text.includes('exec') || text.includes('spawn') || text.includes('command')) {
+                    return 'command';
+                }
+                current = current.parent;
+            }
+            return null;
+        };
+        return {
+            // Check call expressions for sanitization issues
+            CallExpression(node) {
+                const callee = node.callee;
+                // Check for replace() sanitization
+                if (callee.type === 'MemberExpression' &&
+                    callee.property.type === 'Identifier' &&
+                    callee.property.name === 'replace') {
+                    if (isIncompleteReplaceSanitization(node)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node, context)) {
+                            return;
+                        }
+                        context.report({
+                            node,
+                            messageId: 'incompleteHtmlEscaping',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+                // Check for custom sanitizer functions
+                if (callee.type === 'Identifier') {
+                    const functionName = callee.name;
+                    // Check if it's a known dangerous sanitizer pattern
+                    if (functionName.toLowerCase().includes('sanitize') ||
+                        functionName.toLowerCase().includes('escape') ||
+                        functionName.toLowerCase().includes('clean')) {
+                        // If it's not in our safe list, flag it
+                        if (!safeSanitizers.some(safe => functionName.includes(safe))) {
+                            // Check if arguments contain user input
+                            const args = node.arguments;
+                            let hasUserInput = false;
+                            for (const arg of args) {
+                                const argText = sourceCode.getText(arg).toLowerCase();
+                                if (argText.includes('req.') || argText.includes('body') ||
+                                    argText.includes('query') || argText.includes('params') ||
+                                    argText.includes('input') || argText.includes('data')) {
+                                    hasUserInput = true;
+                                    break;
+                                }
+                            }
+                            if (hasUserInput) {
+                                // FALSE POSITIVE REDUCTION
+                                if (safetyChecker.isSafe(node, context)) {
+                                    return;
+                                }
+                                context.report({
+                                    node,
+                                    messageId: 'dangerousSanitizerUsage',
+                                    data: {
+                                        filePath: filename,
+                                        line: String(node.loc?.start.line ?? 0),
+                                    },
+                                });
+                            }
+                        }
+                    }
+                }
+            },
+            // Check assignments that might need sanitization
+            AssignmentExpression(node) {
+                const left = node.left;
+                const right = node.right;
+                // Check for assignments to potentially dangerous properties
+                if (left.type === 'MemberExpression' &&
+                    left.property.type === 'Identifier') {
+                    const propertyName = left.property.name.toLowerCase();
+                    if (['innerhtml', 'outerhtml', 'innertext', 'textcontent'].includes(propertyName)) {
+                        const encodingContext = needsContextEncoding(node);
+                        if (encodingContext === 'html' && propertyName === 'innerhtml') {
+                            // Check if right side is properly sanitized
+                            const rightText = sourceCode.getText(right);
+                            if (!isSafeSanitizer(rightText)) {
+                                // Check if right side contains user input
+                                const hasUserInput = rightText.includes('req.') ||
+                                    rightText.includes('body') ||
+                                    rightText.includes('query') ||
+                                    rightText.includes('input');
+                                if (hasUserInput) {
+                                    // FALSE POSITIVE REDUCTION
+                                    if (safetyChecker.isSafe(node, context)) {
+                                        return;
+                                    }
+                                    context.report({
+                                        node: right,
+                                        messageId: 'insufficientXssProtection',
+                                        data: {
+                                            filePath: filename,
+                                            line: String(node.loc?.start.line ?? 0),
+                                        },
+                                    });
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            // Check string literals that might contain dangerous characters
+            Literal(node) {
+                if (typeof node.value !== 'string') {
+                    return;
+                }
+                const text = node.value;
+                // Check if this string is used in a dangerous context
+                let current = node;
+                let isInDangerousContext = false;
+                while (current && !isInDangerousContext) {
+                    if (current.type === 'AssignmentExpression') {
+                        const left = current.left;
+                        if (left.type === 'MemberExpression' &&
+                            left.property.type === 'Identifier' &&
+                            ['innerHTML', 'outerHTML'].includes(left.property.name)) {
+                            isInDangerousContext = true;
+                            break;
+                        }
+                    }
+                    else if (current.type === 'CallExpression') {
+                        const callee = current.callee;
+                        if (callee.type === 'MemberExpression' &&
+                            callee.property.type === 'Identifier' &&
+                            ['write', 'send', 'json'].includes(callee.property.name)) {
+                            // Could be response output
+                            isInDangerousContext = true;
+                            break;
+                        }
+                    }
+                    current = current.parent;
+                }
+                if (isInDangerousContext) {
+                    // Check if string contains dangerous characters without proper escaping
+                    const hasDangerousChars = dangerousChars.some(char => text.includes(char));
+                    const hasEscaping = text.includes('&lt;') || text.includes('&gt;') ||
+                        text.includes('&quot;') || text.includes('&#x27;') ||
+                        text.includes('&amp;');
+                    if (hasDangerousChars && !hasEscaping) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node, context)) {
+                            return;
+                        }
+                        context.report({
+                            node,
+                            messageId: 'unsafeReplaceSanitization',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+            }
+        };
+    },
+});
+//# sourceMappingURL=no-improper-sanitization.js.map

package/src/rules/security/no-improper-sanitization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-improper-sanitization.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-improper-sanitization.ts"],"names":[],"mappings":";;;AAgBA,4DAAsD;AACtD,4DAA0E;AAC1E,4DAGkC;AAkCrB,QAAA,sBAAsB,GAAG,IAAA,0BAAU,EAA0B;IACxE,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,6CAA6C;SAC3D;QACD,OAAO,EAAE,MAAM;QACf,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,sDAAsD;gBACnE,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,yBAAyB,EAAE,IAAA,gCAAgB,EAAC;gBAC1C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kEAAkE;gBACvE,iBAAiB,EAAE,8CAA8C;aAClE,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,iGAAiG;aACrH,CAAC;YACF,yBAAyB,EAAE,IAAA,gCAAgB,EAAC;gBAC1C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,0DAA0D;gBACvE,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,iEAAiE;gBACtE,iBAAiB,EAAE,iGAAiG;aACrH,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,wCAAwC;gBAC7C,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,wBAAwB,EAAE,IAAA,gCAAgB,EAAC;gBACzC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,4BAA4B;gBACvC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,wCAAwC;gBACrD,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC;YACF,4BAA4B,EAAE,IAAA,gCAAgB,EAAC;gBAC7C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,qDAAqD;gBAC1D,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,sEAAsE;gBAC3E,iBAAiB,EAAE,kFAAkF;aACtG,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,yCAAyC;gBAC9C,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,sCAAsC;gBACjD,WAAW,EAAE,mDAAmD;gBAChE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+DAA+D;gBACpE,iBAAiB,EAAE,iGAAiG;aACrH,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mEAAmE;gBACxE,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,mCAAmC;gBAChD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,yDAAyD;gBAC9D,iBAAiB,EAAE,kFAAkF;aACtG,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,WAAW,EAAE,oCAAoC;gBACjD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kEAAkE;gBACvE,iBAAiB,EAAE,iGAAiG;aACrH,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC;qBAC1F;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;qBAC3E;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;qBAChE;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC;qBAC/D;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,qDAAqD;qBACnE;oBACD,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,0DAA0D;qBACxE;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,cAAc,EAAE,CAAC,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC;YAChG,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YACjF,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC;YAChE,gBAAgB,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC;YACvE,iBAAiB,EAAE,EAAE;YACrB,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;SAClB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,cAAc,GAAG,CAAC,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjG,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAClF,iBAAiB,GAAG,EAAE,EACtB,kBAAkB,GAAG,EAAE,EACvB,UAAU,GAAG,KAAK,GACnB,GAAY,OAAO,CAAC;QAErB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3D,qDAAqD;QACrD,MAAM,aAAa,GAAG,IAAA,mCAAmB,EAAC;YACxC,iBAAiB;YACjB,kBAAkB;YAClB,kBAAkB,EAAE,EAAE;YACtB,UAAU;SACX,CAAC,CAAC;QAEH;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAW,EAAE;YACpD,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,+BAA+B,GAAG,CAAC,cAAuC,EAAW,EAAE;YAC3F,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAEpD,qCAAqC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBAC1C,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/C,0EAA0E;gBAC1E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpF,MAAM,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAExD,OAAO,CAAC,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG,CAAC,UAAyB,EAAiB,EAAE;YACxE,IAAI,OAAO,GAA8B,UAAU,CAAC;YAEpD,6CAA6C;YAC7C,OAAO,OAAO,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;gBAEvD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7D,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1E,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/E,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChF,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;YAC5C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,OAAO;YACL,iDAAiD;YACjD,cAAc,CAAC,IAA6B;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAE3B,mCAAmC;gBACnC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAEvC,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACxC,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,uCAAuC;gBACvC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;oBAEjC,oDAAoD;oBACpD,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC/C,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC7C,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAEjD,wCAAwC;wBACxC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;4BAC9D,wCAAwC;4BACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;4BAC5B,IAAI,YAAY,GAAG,KAAK,CAAC;4BAEzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gCACvB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gCACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oCACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;oCACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oCAC1D,YAAY,GAAG,IAAI,CAAC;oCACpB,MAAM;gCACR,CAAC;4BACH,CAAC;4BAED,IAAI,YAAY,EAAE,CAAC;gCACjB,2BAA2B;gCAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oCACxC,OAAO;gCACT,CAAC;gCAED,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI;oCACJ,SAAS,EAAE,yBAAyB;oCACpC,IAAI,EAAE;wCACJ,QAAQ,EAAE,QAAQ;wCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;qCACxC;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,oBAAoB,CAAC,IAAmC;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBAEzB,4DAA4D;gBAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;oBAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAExC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAEtD,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBAClF,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAEnD,IAAI,eAAe,KAAK,MAAM,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;4BAC/D,4CAA4C;4BAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BAE5C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gCAChC,0CAA0C;gCAC1C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oCAC5B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oCAC1B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oCAC3B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gCAE/C,IAAI,YAAY,EAAE,CAAC;oCACjB,2BAA2B;oCAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wCACxC,OAAO;oCACT,CAAC;oCAED,OAAO,CAAC,MAAM,CAAC;wCACb,IAAI,EAAE,KAAK;wCACX,SAAS,EAAE,2BAA2B;wCACtC,IAAI,EAAE;4CACJ,QAAQ,EAAE,QAAQ;4CAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;yCACxC;qCACF,CAAC,CAAC;gCACL,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gEAAgE;YAChE,OAAO,CAAC,IAAsB;gBAC5B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnC,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;gBAExB,sDAAsD;gBACtD,IAAI,OAAO,GAA8B,IAAI,CAAC;gBAC9C,IAAI,oBAAoB,GAAG,KAAK,CAAC;gBAEjC,OAAO,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACxC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;wBAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;wBAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;4BAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;4BACnC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC5D,oBAAoB,GAAG,IAAI,CAAC;4BAC5B,MAAM;wBACR,CAAC;oBACH,CAAC;yBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;wBAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;4BAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;4BACrC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC7D,2BAA2B;4BAC3B,oBAAoB,GAAG,IAAI,CAAC;4BAC5B,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;gBAC5C,CAAC;gBAED,IAAI,oBAAoB,EAAE,CAAC;oBACzB,wEAAwE;oBACxE,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAChD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAEzC,IAAI,iBAAiB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACtC,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACxC,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,2BAA2B;4BACtC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-improper-type-validation.d.ts

@@ -0,0 +1,10 @@
+import { type SecurityRuleOptions } from '@interlace/eslint-devkit';
+export interface Options extends SecurityRuleOptions {
+    /** Variables that contain user input and should be validated */
+    userInputVariables?: string[];
+    /** Safe type checking functions */
+    safeTypeCheckFunctions?: string[];
+    /** Whether to allow instanceof in same-realm contexts */
+    allowInstanceofSameRealm?: boolean;
+}
+export declare const noImproperTypeValidation: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;