eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-missing-authentication.js

@@ -0,0 +1,322 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noMissingAuthentication = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Common authentication middleware patterns
+ */
+const DEFAULT_AUTH_MIDDLEWARE_PATTERNS = [
+    'authenticate',
+    'auth',
+    'requireAuth',
+    'isAuthenticated',
+    'verifyToken',
+    'checkAuth',
+    'ensureAuthenticated',
+    'passport.authenticate',
+    'jwt',
+    'session',
+];
+/**
+ * Common route handler patterns
+ */
+const DEFAULT_ROUTE_HANDLER_PATTERNS = [
+    'get',
+    'post',
+    'put',
+    'delete',
+    'patch',
+    'all',
+    'use',
+];
+/**
+ * Check if a node is inside an authentication middleware call
+ */
+function isInsideAuthMiddleware(node, sourceCode, authPatterns) {
+    let current = node;
+    while (current) {
+        // Check if current is an argument to a CallExpression
+        if (current.parent && current.parent.type === 'CallExpression') {
+            const callExpr = current.parent;
+            // Verify that current is actually an argument of this call
+            const isArgument = callExpr.arguments.some((arg) => arg === current);
+            if (!isArgument) {
+                // Not an argument, continue traversing
+                if ('parent' in current && current.parent) {
+                    current = current.parent;
+                    continue;
+                }
+                else {
+                    break;
+                }
+            }
+            const callee = callExpr.callee;
+            // Check if it's an authentication middleware call
+            if (callee.type === 'Identifier') {
+                const calleeName = callee.name.toLowerCase();
+                if (authPatterns.some(pattern => calleeName.includes(pattern.toLowerCase()))) {
+                    return true;
+                }
+            }
+            // Check if it's a member expression like app.use(auth())
+            if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') {
+                const propertyName = callee.property.name.toLowerCase();
+                if (propertyName === 'use' || propertyName === 'all') {
+                    // Check if any argument is an auth middleware
+                    for (const arg of callExpr.arguments) {
+                        const argText = sourceCode.getText(arg);
+                        if (authPatterns.some(pattern => argText.toLowerCase().includes(pattern.toLowerCase()))) {
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
+        // Traverse up the AST
+        if ('parent' in current && current.parent) {
+            current = current.parent;
+        }
+        else {
+            break;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a string matches any ignore pattern
+ */
+function matchesIgnorePattern(text, patterns) {
+    return patterns.some(pattern => {
+        try {
+            const regex = new RegExp(pattern, 'i');
+            return regex.test(text);
+        }
+        catch {
+            // Invalid regex - treat as literal string match
+            return text.toLowerCase().includes(pattern.toLowerCase());
+        }
+    });
+}
+exports.noMissingAuthentication = (0, eslint_devkit_2.createRule)({
+    name: 'no-missing-authentication',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects missing authentication checks in route handlers',
+        },
+        hasSuggestions: true,
+        messages: {
+            missingAuthentication: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Missing Authentication',
+                cwe: 'CWE-287',
+                description: 'Route handler missing authentication check: {{route}}',
+                severity: 'CRITICAL',
+                fix: 'Add authentication middleware: app.{{method}}(\'{{path}}\', authenticate(), handler)',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/287.html',
+            }),
+            addAuthentication: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Add Authentication',
+                description: 'Add authentication middleware before route handler',
+                severity: 'LOW',
+                fix: 'app.get("/path", authenticate(), handler)',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/287.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow missing authentication in test files',
+                    },
+                    authMiddlewarePatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: DEFAULT_AUTH_MIDDLEWARE_PATTERNS,
+                        description: 'Authentication middleware patterns to recognize',
+                    },
+                    routeHandlerPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: DEFAULT_ROUTE_HANDLER_PATTERNS,
+                        description: 'Route handler patterns to check',
+                    },
+                    ignorePatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional patterns to ignore',
+                    },
+                    testFilePattern: {
+                        type: 'string',
+                        default: '\\.(test|spec)\\.(ts|tsx|js|jsx)$',
+                        description: 'Test file pattern regex string',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            testFilePattern: '\\.(test|spec)\\.(ts|tsx|js|jsx)$',
+            authMiddlewarePatterns: DEFAULT_AUTH_MIDDLEWARE_PATTERNS,
+            routeHandlerPatterns: DEFAULT_ROUTE_HANDLER_PATTERNS,
+            ignorePatterns: [],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false, testFilePattern = '\\.(test|spec)\\.(ts|tsx|js|jsx)$', authMiddlewarePatterns = DEFAULT_AUTH_MIDDLEWARE_PATTERNS, routeHandlerPatterns = DEFAULT_ROUTE_HANDLER_PATTERNS, ignorePatterns = [], } = options;
+        const filename = context.getFilename();
+        const testFileRegex = new RegExp(testFilePattern);
+        const isTestFile = allowInTests && testFileRegex.test(filename);
+        const sourceCode = context.sourceCode || context.sourceCode;
+        /**
+         * Find variable declaration for an identifier
+         */
+        function findVariableDeclaration(identifier) {
+            const varName = identifier.name;
+            let current = identifier;
+            while (current) {
+                // Search in current scope
+                if (current.type === 'Program' ||
+                    current.type === 'FunctionDeclaration' ||
+                    current.type === 'FunctionExpression' ||
+                    current.type === 'ArrowFunctionExpression') {
+                    const scopeBody = current.type === 'Program'
+                        ? current.body
+                        : (current.body.type === 'BlockStatement' ? current.body.body : []);
+                    for (const stmt of scopeBody) {
+                        if (stmt.type === 'VariableDeclaration') {
+                            for (const declarator of stmt.declarations) {
+                                if (declarator.id.type === 'Identifier' && declarator.id.name === varName) {
+                                    return declarator;
+                                }
+                            }
+                        }
+                    }
+                }
+                // Traverse up
+                if ('parent' in current && current.parent) {
+                    current = current.parent;
+                }
+                else {
+                    break;
+                }
+            }
+            return null;
+        }
+        /**
+         * Check if an identifier was assigned from an auth middleware call
+         */
+        function isIdentifierFromAuthMiddleware(identifier) {
+            const declarator = findVariableDeclaration(identifier);
+            if (!declarator || !declarator.init) {
+                return false;
+            }
+            // Check if init is a CallExpression to auth middleware
+            if (declarator.init.type === 'CallExpression' && declarator.init.callee.type === 'Identifier') {
+                const calleeName = declarator.init.callee.name.toLowerCase();
+                return authMiddlewarePatterns.some(pattern => calleeName.includes(pattern.toLowerCase()));
+            }
+            return false;
+        }
+        /**
+         * Check CallExpression for route handlers without authentication
+         */
+        function checkCallExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check if it's a route handler call (app.get, router.post, etc.)
+            if (node.callee.type === 'MemberExpression') {
+                const property = node.callee.property;
+                if (property.type === 'Identifier') {
+                    const methodName = property.name.toLowerCase();
+                    if (routeHandlerPatterns.includes(methodName)) {
+                        // Extract route path if available
+                        let routePath = 'unknown';
+                        if (node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
+                            routePath = String(node.arguments[0].value);
+                        }
+                        else if (node.arguments.length > 0) {
+                            const pathText = sourceCode.getText(node.arguments[0]);
+                            routePath = pathText;
+                        }
+                        const text = sourceCode.getText(node);
+                        const pathIgnored = matchesIgnorePattern(routePath, ignorePatterns);
+                        if (pathIgnored) {
+                            console.log('DEBUG MSG: Ignored path:', routePath);
+                            return;
+                        }
+                        if (matchesIgnorePattern(text, ignorePatterns)) {
+                            console.log('DEBUG MSG: Ignored text:', text);
+                            return;
+                        }
+                        // Check if authentication middleware is present in arguments
+                        let hasAuth = false;
+                        for (const arg of node.arguments) {
+                            const argText = sourceCode.getText(arg);
+                            if (authMiddlewarePatterns.some(pattern => argText.toLowerCase().includes(pattern.toLowerCase()))) {
+                                hasAuth = true;
+                                break;
+                            }
+                            // Check if argument is a call to auth middleware
+                            if (arg.type === 'CallExpression' && arg.callee.type === 'Identifier') {
+                                const calleeName = arg.callee.name.toLowerCase();
+                                if (authMiddlewarePatterns.some(pattern => calleeName.includes(pattern.toLowerCase()))) {
+                                    hasAuth = true;
+                                    break;
+                                }
+                            }
+                            // Check if argument is an identifier assigned from auth middleware
+                            if (arg.type === 'Identifier' && isIdentifierFromAuthMiddleware(arg)) {
+                                hasAuth = true;
+                                break;
+                            }
+                        }
+                        // Check if the handler function itself is inside an auth middleware context
+                        if (!hasAuth && node.arguments.length > 0) {
+                            const lastArg = node.arguments[node.arguments.length - 1];
+                            if (lastArg.type === 'ArrowFunctionExpression' ||
+                                lastArg.type === 'FunctionExpression') {
+                                // Check if the handler is inside an auth middleware call
+                                if (isInsideAuthMiddleware(lastArg, sourceCode, authMiddlewarePatterns)) {
+                                    hasAuth = true;
+                                }
+                            }
+                        }
+                        if (!hasAuth) {
+                            context.report({
+                                node: node.callee,
+                                messageId: 'missingAuthentication',
+                                data: {
+                                    route: `${methodName}(${routePath})`,
+                                    method: methodName,
+                                    path: routePath,
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'addAuthentication',
+                                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                        fix: (_fixer) => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return {
+            CallExpression: checkCallExpression,
+        };
+    },
+});
+//# sourceMappingURL=no-missing-authentication.js.map

package/src/rules/security/no-missing-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-missing-authentication.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-missing-authentication.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAuBtD;;GAEG;AACH,MAAM,gCAAgC,GAAG;IACvC,cAAc;IACd,MAAM;IACN,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,uBAAuB;IACvB,KAAK;IACL,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,8BAA8B,GAAG;IACrC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC;AAEF;;GAEG;AACH,SAAS,sBAAsB,CAC7B,IAAmB,EACnB,UAA+B,EAC/B,YAAsB;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IAEzC,OAAO,OAAO,EAAE,CAAC;QACf,sDAAsD;QACtD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAiC,CAAC;YAE3D,2DAA2D;YAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAoC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACtG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,uCAAuC;gBACvC,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;oBAC1C,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAE/B,kDAAkD;YAClD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC7E,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,yDAAyD;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBACrD,8CAA8C;oBAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;wBACrC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBACxC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;4BACxF,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAAkB;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,uBAAuB,GAAG,IAAA,0BAAU,EAA0B;IACzE,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,yDAAyD;SACvE;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wBAAwB;gBACnC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,sFAAsF;gBAC3F,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,oDAAoD;gBACjE,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2CAA2C;gBAChD,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,4CAA4C;qBAC1D;oBACD,sBAAsB,EAAE;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,gCAAgC;wBACzC,WAAW,EAAE,iDAAiD;qBAC/D;oBACD,oBAAoB,EAAE;wBACpB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,8BAA8B;wBACvC,WAAW,EAAE,iCAAiC;qBAC/C;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,+BAA+B;qBAC7C;oBACD,eAAe,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,mCAAmC;wBAC5C,WAAW,EAAE,gCAAgC;qBAC9C;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,mCAAmC;YACpD,sBAAsB,EAAE,gCAAgC;YACxD,oBAAoB,EAAE,8BAA8B;YACpD,cAAc,EAAE,EAAE;SACnB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,eAAe,GAAG,mCAAmC,EACrD,sBAAsB,GAAG,gCAAgC,EACzD,oBAAoB,GAAG,8BAA8B,EACrD,cAAc,GAAG,EAAE,GACpB,GAAG,OAAkB,CAAC;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAE5D;;WAEG;QACH,SAAS,uBAAuB,CAAC,UAA+B;YAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;YAChC,IAAI,OAAO,GAAyB,UAAU,CAAC;YAE/C,OAAO,OAAO,EAAE,CAAC;gBACf,0BAA0B;gBAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,qBAAqB;oBACtC,OAAO,CAAC,IAAI,KAAK,oBAAoB;oBACrC,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS;wBAC1C,CAAC,CAAC,OAAO,CAAC,IAAI;wBACd,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAEtE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;wBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;4BACxC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gCAC3C,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oCAC1E,OAAO,UAAU,CAAC;gCACpB,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,cAAc;gBACd,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,MAAM;gBACR,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;WAEG;QACH,SAAS,8BAA8B,CAAC,UAA+B;YACrE,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,uDAAuD;YACvD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9F,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7D,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;WAEG;QACH,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAE/C,IAAI,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC9C,kCAAkC;wBAClC,IAAI,SAAS,GAAG,SAAS,CAAC;wBAC1B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BACtE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;wBAC9C,CAAC;6BAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;4BACvD,SAAS,GAAG,QAAQ,CAAC;wBACvB,CAAC;wBAED,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACtC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;wBACpE,IAAI,WAAW,EAAE,CAAC;4BACf,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;4BACnD,OAAO;wBACV,CAAC;wBACD,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;4BAC9C,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;4BAC9C,OAAO;wBACV,CAAC;wBAED,6DAA6D;wBAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;wBACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;4BACjC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACxC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACtD,EAAE,CAAC;gCACF,OAAO,GAAG,IAAI,CAAC;gCACf,MAAM;4BACR,CAAC;4BAED,iDAAiD;4BACjD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gCACtE,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gCACjD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACxC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAC3C,EAAE,CAAC;oCACF,OAAO,GAAG,IAAI,CAAC;oCACf,MAAM;gCACR,CAAC;4BACH,CAAC;4BAED,mEAAmE;4BACnE,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;gCACrE,OAAO,GAAG,IAAI,CAAC;gCACf,MAAM;4BACR,CAAC;wBACH,CAAC;wBAED,4EAA4E;wBAC5E,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;4BAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB;gCAC1C,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gCAC1C,yDAAyD;gCACzD,IAAI,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,CAAC;oCACxE,OAAO,GAAG,IAAI,CAAC;gCACjB,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,IAAI,CAAC,MAAM;gCACjB,SAAS,EAAE,uBAAuB;gCAClC,IAAI,EAAE;oCACJ,KAAK,EAAE,GAAG,UAAU,IAAI,SAAS,GAAG;oCACpC,MAAM,EAAE,UAAU;oCAClB,IAAI,EAAE,SAAS;iCAChB;gCACD,OAAO,EAAE;oCACP;wCACE,SAAS,EAAE,mBAAmB;wCAC9B,6DAA6D;wCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;qCAC1C;iCACF;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-missing-cors-check.d.ts

@@ -0,0 +1,9 @@
+export interface Options {
+    /** Allow missing CORS checks in test files. Default: false */
+    allowInTests?: boolean;
+    /** Trusted CORS libraries. Default: ['cors', '@koa/cors', 'express-cors'] */
+    trustedLibraries?: string[];
+    /** Additional safe patterns to ignore. Default: [] */
+    ignorePatterns?: string[];
+}
+export declare const noMissingCorsCheck: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;