eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-ldap-injection.js

@@ -0,0 +1,449 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noLdapInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const eslint_devkit_3 = require("@interlace/eslint-devkit");
+exports.noLdapInjection = (0, eslint_devkit_1.createRule)({
+    name: 'no-ldap-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects LDAP injection vulnerabilities',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            ldapInjection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'LDAP Injection',
+                cwe: 'CWE-90',
+                description: 'LDAP injection vulnerability detected',
+                severity: '{{severity}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            unsafeLdapFilter: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe LDAP Filter',
+                cwe: 'CWE-90',
+                description: 'LDAP filter constructed with unsafe string operations',
+                severity: 'HIGH',
+                fix: 'Use ldap.escape.filterValue() to escape user input',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            unescapedLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unescaped LDAP Input',
+                cwe: 'CWE-90',
+                description: 'LDAP operation uses unescaped user input',
+                severity: 'MEDIUM',
+                fix: 'Escape all user input before LDAP operations',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            dangerousLdapOperation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Dangerous LDAP Operation',
+                cwe: 'CWE-90',
+                description: 'LDAP operation allows dangerous filter patterns',
+                severity: 'HIGH',
+                fix: 'Validate LDAP filters and restrict allowed operations',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            useLdapEscaping: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use LDAP Escaping',
+                description: 'Use proper LDAP escaping functions',
+                severity: 'LOW',
+                fix: 'Use ldap.escape.filterValue() or equivalent',
+                documentationLink: 'https://www.npmjs.com/package/ldap-escape',
+            }),
+            validateLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Validate LDAP Input',
+                description: 'Validate LDAP input before processing',
+                severity: 'LOW',
+                fix: 'Validate input against allowed patterns',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            useParameterizedLdap: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use Parameterized LDAP',
+                description: 'Use parameterized LDAP queries when possible',
+                severity: 'LOW',
+                fix: 'Use prepared LDAP statements or safe construction',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            strategyInputValidation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Input Validation Strategy',
+                description: 'Validate LDAP input at application boundary',
+                severity: 'LOW',
+                fix: 'Implement input validation and length limits',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            strategySafeLibraries: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Safe Libraries Strategy',
+                description: 'Use LDAP libraries with built-in escaping',
+                severity: 'LOW',
+                fix: 'Use ldapjs or libraries with automatic escaping',
+                documentationLink: 'https://www.npmjs.com/package/ldapjs',
+            }),
+            strategyFilterConstruction: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Filter Construction Strategy',
+                description: 'Use safe LDAP filter construction methods',
+                severity: 'LOW',
+                fix: 'Build filters programmatically with escaped values',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ldapFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
+                    },
+                    ldapEscapeFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
+                    },
+                    ldapValidationFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional function names to consider as LDAP sanitizers',
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional JSDoc annotations to consider as safe markers',
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Disable all false positive detection (strict mode)',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            ldapFunctions: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
+            ldapEscapeFunctions: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
+            ldapValidationFunctions: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { ldapFunctions = ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'], ldapEscapeFunctions = ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'], ldapValidationFunctions = ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
+        const sourceCode = context.sourceCode || context.sourceCode;
+        const filename = context.filename || context.filename;
+        // Create safety checker for false positive detection
+        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
+            trustedSanitizers,
+            trustedAnnotations,
+            trustedOrmPatterns: [],
+            strictMode,
+        });
+        /**
+         * Check if this is an LDAP-related operation
+         */
+        const isLdapOperation = (node) => {
+            const callee = node.callee;
+            // Check for LDAP method calls
+            if (callee.type === 'MemberExpression' &&
+                callee.property.type === 'Identifier' &&
+                ldapFunctions.includes(callee.property.name)) {
+                return true;
+            }
+            return false;
+        };
+        /**
+         * Check if LDAP filter contains dangerous patterns
+         */
+        const containsDangerousLdapFilter = (filterText) => {
+            // Dangerous LDAP filter patterns
+            const dangerousPatterns = [
+                /\*\)$/, // Ending with *) to match everything
+                /\|\)$/, // Ending with |) for OR operations
+                /&\)$/, // Ending with &) for AND operations
+                /!\)$/, // Ending with !) for NOT operations
+                /\*\|\*/, // *|* pattern for matching everything
+                /\*&\*/, // *&* pattern
+                /\*!/, // NOT operations that could be exploited
+            ];
+            return dangerousPatterns.some(pattern => pattern.test(filterText));
+        };
+        /**
+         * Check if string contains LDAP filter interpolation
+         */
+        const containsLdapInterpolation = (text) => {
+            return /\$\{[^}]+\}/.test(text) || /'[^']*\+[^+]*'/.test(text) || /"[^"]*\+[^+]*"/.test(text);
+        };
+        /**
+         * Check if LDAP input is from untrusted source
+         */
+        const isUntrustedLdapInput = (inputNode) => {
+            // Check member expressions like req.query.name, req.params.id, etc.
+            if (inputNode.type === 'MemberExpression') {
+                const fullName = sourceCode.getText(inputNode).toLowerCase();
+                return fullName.includes('req.') || fullName.includes('request.') ||
+                    fullName.includes('query.') || fullName.includes('params.') ||
+                    fullName.includes('body.');
+            }
+            // In test contexts, also consider certain variable names as potentially untrusted
+            if (inputNode.type === 'Identifier') {
+                const varName = inputNode.name.toLowerCase();
+                return ['userid', 'username', 'userinput', 'input', 'term', 'name', 'search', 'query', 'param', 'password', 'id', 'dn'].includes(varName) ||
+                    varName.startsWith('user') || varName.startsWith('input') || varName.endsWith('input') ||
+                    varName.includes('user') || varName.includes('input');
+            }
+            return false;
+        };
+        /**
+         * Check if LDAP input has been escaped
+         */
+        const isLdapInputEscaped = (inputNode) => {
+            let current = inputNode;
+            while (current) {
+                if (current.type === 'CallExpression') {
+                    const callee = current.callee;
+                    // Check for escape function calls
+                    if (callee.type === 'MemberExpression' &&
+                        callee.property.type === 'Identifier') {
+                        const propertyName = callee.property.name;
+                        if (ldapEscapeFunctions.some(escapeFunc => escapeFunc.includes(propertyName) ||
+                            propertyName.includes('escape'))) {
+                            return true;
+                        }
+                    }
+                    // Check for validation function calls
+                    if (callee.type === 'Identifier' &&
+                        ldapValidationFunctions.includes(callee.name)) {
+                        return true;
+                    }
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        return {
+            // Check LDAP function calls
+            CallExpression(node) {
+                if (!isLdapOperation(node)) {
+                    return;
+                }
+                const args = node.arguments;
+                if (args.length < 2) {
+                    return; // Need at least base DN and filter/options
+                }
+                // Check filter argument (usually the second argument)
+                const filterArg = args[1];
+                // Check if filter argument comes from untrusted input (like req.query.filter)
+                if (isUntrustedLdapInput(filterArg)) {
+                    // FALSE POSITIVE REDUCTION
+                    if (safetyChecker.isSafe(filterArg, context)) {
+                        return;
+                    }
+                    context.report({
+                        node: filterArg,
+                        messageId: 'unescapedLdapInput',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useLdapEscaping',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                }
+                else if (filterArg.type === 'TemplateLiteral' && filterArg.expressions.length > 0) {
+                    // Special handling for template literals with any expressions in LDAP calls
+                    // This is a more aggressive check for LDAP injection in function calls
+                    const hasAnyExpression = filterArg.expressions.some(() => true);
+                    if (hasAnyExpression) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(filterArg, context)) {
+                            return;
+                        }
+                        context.report({
+                            node: filterArg,
+                            messageId: 'unescapedLdapInput',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                            suggest: [
+                                {
+                                    messageId: 'useLdapEscaping',
+                                    fix: () => null,
+                                },
+                            ],
+                        });
+                    }
+                }
+            },
+            // Check variable declarations with LDAP filters
+            VariableDeclarator(node) {
+                if (!node.init || node.id.type !== 'Identifier') {
+                    return;
+                }
+                const varName = node.id.name.toLowerCase();
+                // Check if variable name suggests LDAP-related content
+                const isLdapRelated = varName.includes('filter') || varName.includes('ldap') ||
+                    varName.includes('query') || varName.includes('search') ||
+                    varName.includes('dn') || varName.includes('bind');
+                // If not obviously LDAP-related, check if the assigned value looks like LDAP
+                if (!isLdapRelated && node.init) {
+                    const initText = sourceCode.getText(node.init);
+                    if (!initText.includes('(') || !initText.includes(')')) {
+                        return;
+                    }
+                }
+                // Check if assigned value contains dangerous LDAP patterns
+                if (node.init.type === 'Literal' && typeof node.init.value === 'string') {
+                    if (containsDangerousLdapFilter(node.init.value)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node.init, context)) {
+                            return;
+                        }
+                        context.report({
+                            node: node.init,
+                            messageId: 'dangerousLdapOperation',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+                else if (node.init.type === 'TemplateLiteral') {
+                    // Handle template literals with interpolation
+                    const fullText = sourceCode.getText(node.init);
+                    // Check for interpolation in LDAP-like expressions
+                    if (containsLdapInterpolation(fullText)) {
+                        // Check if any interpolated values are untrusted
+                        const hasUntrustedInterpolation = node.init.expressions.some((expr) => isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr));
+                        if (hasUntrustedInterpolation) {
+                            // FALSE POSITIVE REDUCTION
+                            if (safetyChecker.isSafe(node.init, context)) {
+                                return;
+                            }
+                            context.report({
+                                node: node.init,
+                                messageId: 'unsafeLdapFilter',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'useLdapEscaping',
+                                        fix: () => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                    // Check for dangerous patterns in template literals
+                    if (containsDangerousLdapFilter(fullText)) {
+                        // FALSE POSITIVE REDUCTION
+                        if (safetyChecker.isSafe(node.init, context)) {
+                            return;
+                        }
+                        context.report({
+                            node: node.init,
+                            messageId: 'dangerousLdapOperation',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+                else if (node.init.type === 'BinaryExpression' && node.init.operator === '+') {
+                    // Handle string concatenation
+                    const fullText = sourceCode.getText(node.init);
+                    // Check if this looks like LDAP filter construction
+                    if (fullText.includes('(') && fullText.includes(')')) {
+                        // Check if untrusted input is involved (recursive check)
+                        const hasUntrustedInput = (expr) => {
+                            if (isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr)) {
+                                return true;
+                            }
+                            if (expr.type === 'BinaryExpression' && expr.operator === '+') {
+                                return hasUntrustedInput(expr.left) || hasUntrustedInput(expr.right);
+                            }
+                            return false;
+                        };
+                        if (hasUntrustedInput(node.init.left) || hasUntrustedInput(node.init.right)) {
+                            // FALSE POSITIVE REDUCTION
+                            if (safetyChecker.isSafe(node.init, context)) {
+                                return;
+                            }
+                            context.report({
+                                node: node.init,
+                                messageId: 'ldapInjection',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                    severity: 'HIGH',
+                                    safeAlternative: 'Use ldap.escape.filterValue() or parameterized LDAP queries',
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'useLdapEscaping',
+                                        fix: () => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                }
+                else if (isUntrustedLdapInput(node.init) && !isLdapInputEscaped(node.init)) {
+                    // FALSE POSITIVE REDUCTION
+                    if (safetyChecker.isSafe(node.init, context)) {
+                        return;
+                    }
+                    context.report({
+                        node: node.init,
+                        messageId: 'ldapInjection',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                            severity: 'MEDIUM',
+                            safeAlternative: 'Use proper LDAP escaping and validation',
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useLdapEscaping',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                }
+            }
+        };
+    },
+});
+//# sourceMappingURL=no-ldap-injection.js.map

package/src/rules/security/no-ldap-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-ldap-injection.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-ldap-injection.ts"],"names":[],"mappings":";;;AAmBA,4DAAsD;AACtD,4DAA0E;AAC1E,4DAGkC;AA4BrB,QAAA,eAAe,GAAG,IAAA,0BAAU,EAA0B;IACjE,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,wCAAwC;SACtD;QACD,OAAO,EAAE,MAAM;QACf,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gBAAgB;gBAC3B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,oBAAoB;gBAC/B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,gCAAgC;aACpD,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0CAA0C;gBACvD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,8CAA8C;gBACnD,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,iDAAiD;gBAC9D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,gCAAgC;aACpD,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,oCAAoC;gBACjD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,6CAA6C;gBAClD,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,yCAAyC;gBAC9C,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,gCAAgC;aACpD,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,8CAA8C;gBACnD,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,sCAAsC;aAC1D,CAAC;YACF,0BAA0B,EAAE,IAAA,gCAAgB,EAAC;gBAC3C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,gCAAgC;aACpD,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;qBACjF;oBACD,mBAAmB,EAAE;wBACnB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,CAAC;qBAC9E;oBACD,uBAAuB,EAAE;wBACvB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;qBAC1F;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,0DAA0D;qBACxE;oBACD,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,0DAA0D;qBACxE;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;YACtF,mBAAmB,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,CAAC;YACzF,uBAAuB,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;YACzG,iBAAiB,EAAE,EAAE;YACrB,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;SAClB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,EACvF,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,CAAC,EAC1F,uBAAuB,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAC1G,iBAAiB,GAAG,EAAE,EACtB,kBAAkB,GAAG,EAAE,EACvB,UAAU,GAAG,KAAK,GACnB,GAAY,OAAO,CAAC;QAErB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAEtD,qDAAqD;QACrD,MAAM,aAAa,GAAG,IAAA,mCAAmB,EAAC;YACxC,iBAAiB;YACjB,kBAAkB;YAClB,kBAAkB,EAAE,EAAE;YACtB,UAAU;SACX,CAAC,CAAC;QAEH;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAW,EAAE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAE3B,8BAA8B;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBACrC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,2BAA2B,GAAG,CAAC,UAAkB,EAAW,EAAE;YAClE,iCAAiC;YACjC,MAAM,iBAAiB,GAAG;gBACxB,OAAO,EAAM,qCAAqC;gBAClD,OAAO,EAAM,mCAAmC;gBAChD,MAAM,EAAO,oCAAoC;gBACjD,MAAM,EAAO,oCAAoC;gBACjD,QAAQ,EAAK,sCAAsC;gBACnD,OAAO,EAAM,cAAc;gBAC3B,KAAK,EAAQ,yCAAyC;aACvD,CAAC;YAEF,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,yBAAyB,GAAG,CAAC,IAAY,EAAW,EAAE;YAC1D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG,CAAC,SAAwB,EAAW,EAAE;YACjE,oEAAoE;YACpE,IAAI,SAAS,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC1D,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAC3D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YAED,kFAAkF;YAClF,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAClI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,SAAwB,EAAW,EAAE;YAC/D,IAAI,OAAO,GAA8B,SAAS,CAAC;YAEnD,OAAO,OAAO,EAAE,CAAC;gBACf,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBAE9B,kCAAkC;oBAClC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAC1C,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CACxC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;4BACjC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAChC,EAAE,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;oBAED,sCAAsC;oBACtC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;wBAC5B,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;YAC5C,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAGF,OAAO;YACL,4BAA4B;YAC5B,cAAc,CAAC,IAA6B;gBAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,OAAO,CAAC,2CAA2C;gBACrD,CAAC;gBAED,sDAAsD;gBACtD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAE1B,8EAA8E;gBAC9E,IAAI,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpC,2BAA2B;oBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC7C,OAAO;oBACT,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,SAAS;wBACf,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;yBACxC;wBACD,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,iBAAiB;gCAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;6BAChB;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpF,4EAA4E;oBAC5E,uEAAuE;oBACvE,MAAM,gBAAgB,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBAChE,IAAI,gBAAgB,EAAE,CAAC;wBACrB,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;4BAC7C,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,SAAS;4BACf,SAAS,EAAE,oBAAoB;4BAC/B,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;4BACD,OAAO,EAAE;gCACP;oCACE,SAAS,EAAE,iBAAiB;oCAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;iCAChB;6BACF;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAID,gDAAgD;YAChD,kBAAkB,CAAC,IAAiC;gBAClD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAChD,OAAO;gBACT,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,uDAAuD;gBACvD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAExE,6EAA6E;gBAC7E,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvD,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,2DAA2D;gBAC3D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxE,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACjD,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BAC7C,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBAChD,8CAA8C;oBAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAE/C,mDAAmD;oBACnD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACxC,iDAAiD;wBACjD,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAyB,EAAE,EAAE,CACzF,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CACxD,CAAC;wBAEF,IAAI,yBAAyB,EAAE,CAAC;4BAC9B,2BAA2B;4BAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCAC7C,OAAO;4BACT,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,SAAS,EAAE,kBAAkB;gCAC7B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;gCACD,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,iBAAiB;wCAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qCAChB;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,IAAI,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC1C,2BAA2B;wBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BAC7C,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAC/E,8BAA8B;oBAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAE/C,oDAAoD;oBACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrD,yDAAyD;wBACzD,MAAM,iBAAiB,GAAG,CAAC,IAAyB,EAAW,EAAE;4BAC/D,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC5D,OAAO,IAAI,CAAC;4BACd,CAAC;4BACD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gCAC9D,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACvE,CAAC;4BACD,OAAO,KAAK,CAAC;wBACf,CAAC,CAAC;wBAEF,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC5E,2BAA2B;4BAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCAC7C,OAAO;4BACT,CAAC;4BAED,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,SAAS,EAAE,eAAe;gCAC1B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;oCACvC,QAAQ,EAAE,MAAM;oCAChB,eAAe,EAAE,6DAA6D;iCAC/E;gCACD,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,iBAAiB;wCAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qCAChB;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7E,2BAA2B;oBAC3B,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC7C,OAAO;oBACT,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,SAAS,EAAE,eAAe;wBAC1B,IAAI,EAAE;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;4BACvC,QAAQ,EAAE,QAAQ;4BAClB,eAAe,EAAE,yCAAyC;yBAC3D;wBACD,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,iBAAiB;gCAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;6BAChB;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-missing-authentication.d.ts

@@ -0,0 +1,13 @@
+export interface Options {
+    /** Allow missing authentication in test files. Default: false */
+    allowInTests?: boolean;
+    /** Test file pattern regex string. Default: '\\.(test|spec)\\.(ts|tsx|js|jsx)$' */
+    testFilePattern?: string;
+    /** Authentication middleware patterns to recognize. Default: ['authenticate', 'auth', 'requireAuth', 'isAuthenticated'] */
+    authMiddlewarePatterns?: string[];
+    /** Route handler patterns to check. Default: ['get', 'post', 'put', 'delete', 'patch', 'all'] */
+    routeHandlerPatterns?: string[];
+    /** Additional patterns to ignore. Default: [] */
+    ignorePatterns?: string[];
+}
+export declare const noMissingAuthentication: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;