eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-missing-cors-check.js

@@ -0,0 +1,449 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noMissingCorsCheck = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Check if a node is inside a CORS configuration
+ * Currently unused - kept for future use
+ * @coverage-note This function is intentionally unused and kept for future enhancements.
+ * It cannot be tested directly as it's not called by any code path.
+ */
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+function isInsideCorsConfig(node, sourceCode, trustedLibraries) {
+    let current = node;
+    while (current) {
+        // Check for CORS middleware usage
+        if (current.type === 'CallExpression') {
+            const callee = current.callee;
+            // Check if it's a CORS middleware call
+            if (callee.type === 'Identifier') {
+                const calleeName = callee.name.toLowerCase();
+                if (['cors', 'use', 'enable'].includes(calleeName)) {
+                    return true;
+                }
+            }
+            // Check if it's a trusted library call
+            if (callee.type === 'MemberExpression') {
+                const object = callee.object;
+                if (object.type === 'Identifier') {
+                    const objectName = object.name.toLowerCase();
+                    if (trustedLibraries.some(lib => objectName.includes(lib.toLowerCase()))) {
+                        return true;
+                    }
+                }
+            }
+        }
+        // Check for CORS configuration object
+        if (current.type === 'ObjectExpression') {
+            const text = sourceCode.getText(current);
+            if (/\b(origin|credentials|allowedOrigins|allowedHeaders)\s*:/i.test(text)) {
+                // Check if it has proper validation (not just '*')
+                if (!/\borigin\s*:\s*['"]\*['"]/i.test(text)) {
+                    return true;
+                }
+            }
+        }
+        // Traverse up the AST
+        if ('parent' in current && current.parent) {
+            current = current.parent;
+        }
+        else {
+            break;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a string matches any ignore pattern
+ */
+function matchesIgnorePattern(text, ignorePatterns) {
+    return ignorePatterns.some(pattern => {
+        try {
+            const regex = new RegExp(pattern, 'i');
+            return regex.test(text);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+exports.noMissingCorsCheck = (0, eslint_devkit_2.createRule)({
+    name: 'no-missing-cors-check',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects missing CORS validation (wildcard CORS, missing origin check)',
+        },
+        hasSuggestions: true,
+        messages: {
+            missingCorsCheck: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Missing CORS Validation',
+                cwe: 'CWE-346',
+                description: 'Missing CORS validation detected: {{issue}}',
+                severity: 'HIGH',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/346.html',
+            }),
+            useOriginValidation: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Validate Origin',
+                description: 'Validate CORS origin',
+                severity: 'LOW',
+                fix: 'cors({ origin: (origin, cb) => allowedOrigins.includes(origin) ? cb(null, true) : cb(new Error()) })',
+                documentationLink: 'https://github.com/expressjs/cors#configuration-options',
+            }),
+            useCorsMiddleware: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use CORS Middleware',
+                description: 'Use CORS middleware with origin validation',
+                severity: 'LOW',
+                fix: 'app.use(cors({ origin: allowedOrigins }))',
+                documentationLink: 'https://github.com/expressjs/cors',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow missing CORS checks in test files',
+                    },
+                    trustedLibraries: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Custom CORS libraries to trust (wildcard origins in these libraries will not be reported)',
+                    },
+                    ignorePatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional safe patterns to ignore',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            trustedLibraries: [], // Empty by default - users can add custom CORS libraries they trust
+            ignorePatterns: [],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false, trustedLibraries: corsTrustedLibraries = [], ignorePatterns = [], } = options;
+        const trustedLibraries = corsTrustedLibraries;
+        const filename = context.getFilename();
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        const sourceCode = context.sourceCode || context.sourceCode;
+        function checkLiteral(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for wildcard CORS origin
+            if (node.value === '*' && typeof node.value === 'string') {
+                const text = sourceCode.getText(node);
+                // Check if it matches any ignore pattern
+                if (matchesIgnorePattern(text, ignorePatterns)) {
+                    return;
+                }
+                // Check if it's in contexts handled by other checkers
+                // 1. setHeader/header calls - checkMemberExpression handles these
+                // 2. app.use(cors({ origin: "*" })) - checkCallExpression handles these with suggestions
+                let shouldSkip = false;
+                let current = node;
+                while (current && current.parent) {
+                    current = current.parent;
+                    if (current.type === 'CallExpression') {
+                        const callText = sourceCode.getText(current);
+                        // Check if it's a setHeader/header call with Access-Control-Allow-Origin
+                        // Skip these - checkMemberExpression handles them
+                        if (/\b(setHeader|header)\s*\(/i.test(callText) && /\bAccess-Control-Allow-Origin\b/i.test(callText)) {
+                            shouldSkip = true;
+                            break;
+                        }
+                        // Check if it's app.use(cors({ origin: "*" })) - checkCallExpression handles these with suggestions
+                        if (/\buse\s*\(/i.test(callText) && /\bcors\s*\(/i.test(callText)) {
+                            // Check if the literal is in an object property named "origin"
+                            if (node.parent && node.parent.type === 'Property') {
+                                const prop = node.parent;
+                                if (prop.key.type === 'Identifier' && prop.key.name === 'origin') {
+                                    shouldSkip = true;
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                }
+                // Skip if it's in a context handled by another checker
+                if (shouldSkip) {
+                    return;
+                }
+                // Check if it's in a CORS-related context
+                // Only report if it's actually in a CORS configuration (app.use(cors(...)), etc.)
+                // Not just any object with origin: "*"
+                let isActualCorsContext = false;
+                // Check if it's in app.use(cors(...)) or similar
+                current = node;
+                while (current && current.parent) {
+                    current = current.parent;
+                    if (current.type === 'CallExpression') {
+                        const callText = sourceCode.getText(current);
+                        // Check if it's a CORS middleware call
+                        if (/\b(use|cors)\s*\(/i.test(callText) && /\bcors\s*\(/i.test(callText)) {
+                            isActualCorsContext = true;
+                            break;
+                        }
+                    }
+                }
+                // Also check if it's in an object property with name "origin" or "allowedOrigins"
+                // but only if it's in a CORS-related call expression
+                if (node.parent && node.parent.type === 'Property') {
+                    const prop = node.parent;
+                    if (prop.key.type === 'Identifier') {
+                        const keyName = prop.key.name.toLowerCase();
+                        if (keyName === 'origin' || keyName === 'allowedorigins') {
+                            // Check if this property is in a CORS call context
+                            let inCorsCall = false;
+                            let checkNode = prop;
+                            while (checkNode && checkNode.parent) {
+                                checkNode = checkNode.parent;
+                                if (checkNode.type === 'CallExpression') {
+                                    const callText = sourceCode.getText(checkNode);
+                                    if (/\bcors\s*\(/i.test(callText) ||
+                                        (/\buse\s*\(/i.test(callText) && /\bcors/i.test(callText))) {
+                                        inCorsCall = true;
+                                        break;
+                                    }
+                                }
+                            }
+                            if (inCorsCall) {
+                                // Always report wildcard CORS origin - it's never safe
+                                context.report({
+                                    node,
+                                    messageId: 'missingCorsCheck',
+                                    data: {
+                                        issue: 'Wildcard CORS origin (*) allows all origins',
+                                        safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
+                                    },
+                                    suggest: [
+                                        {
+                                            messageId: 'useOriginValidation',
+                                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                            fix: (_fixer) => null,
+                                        },
+                                    ],
+                                });
+                                return;
+                            }
+                        }
+                    }
+                }
+                // Only report if it's in an actual CORS context
+                if (isActualCorsContext) {
+                    // Always report wildcard CORS origin - it's never safe
+                    context.report({
+                        node,
+                        messageId: 'missingCorsCheck',
+                        data: {
+                            issue: 'Wildcard CORS origin (*) allows all origins',
+                            safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useOriginValidation',
+                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                fix: (_fixer) => null,
+                            },
+                        ],
+                    });
+                }
+            }
+        }
+        function checkCallExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for app.use(cors({ origin: "*" })) or similar
+            if (node.callee.type === 'MemberExpression') {
+                const property = node.callee.property;
+                if (property.type === 'Identifier' && property.name === 'use') {
+                    // Check if CORS is being used
+                    const text = sourceCode.getText(node);
+                    // Check if it matches any ignore pattern
+                    if (matchesIgnorePattern(text, ignorePatterns)) {
+                        return;
+                    }
+                    // Check if it's a CORS middleware call
+                    // Check for cors() or trusted library calls
+                    const firstArg = node.arguments.length > 0 ? node.arguments[0] : null;
+                    let isCorsCall = /\bcors\s*\(/i.test(text);
+                    if (!isCorsCall && firstArg && firstArg.type === 'CallExpression' && firstArg.callee.type === 'Identifier') {
+                        const callee = firstArg.callee;
+                        const calleeName = callee.name.toLowerCase();
+                        // Check if it's the standard 'cors' library or a trusted library
+                        isCorsCall = calleeName === 'cors' || trustedLibraries.some(lib => {
+                            return calleeName.includes(lib.toLowerCase());
+                        });
+                    }
+                    // Check if it's a trusted library - skip if explicitly trusted
+                    let isTrustedLibrary = false;
+                    if (firstArg && firstArg.type === 'CallExpression' && firstArg.callee.type === 'Identifier') {
+                        const calleeName = firstArg.callee.name.toLowerCase();
+                        isTrustedLibrary = trustedLibraries.some(lib => calleeName.includes(lib.toLowerCase()));
+                    }
+                    if (isTrustedLibrary) {
+                        return; // Trusted library, skip
+                    }
+                    // Check if it's a CORS call
+                    if (/\bcors\s*\(/i.test(text) || isCorsCall) {
+                        // Check arguments for wildcard origin
+                        // For app.use(cors({ origin: "*" })), we need to check the arguments to cors(), not app.use()
+                        const corsCallArg = firstArg && firstArg.type === 'CallExpression' ? firstArg : null;
+                        const argsToCheck = corsCallArg ? corsCallArg.arguments : node.arguments;
+                        for (const arg of argsToCheck) {
+                            if (arg.type === 'ObjectExpression') {
+                                // Check for origin property with wildcard value
+                                for (const prop of arg.properties) {
+                                    if (prop.type === 'Property' &&
+                                        prop.key.type === 'Identifier' &&
+                                        prop.key.name === 'origin' &&
+                                        prop.value.type === 'Literal' &&
+                                        prop.value.value === '*') {
+                                        context.report({
+                                            node: prop.value,
+                                            messageId: 'missingCorsCheck',
+                                            data: {
+                                                issue: 'Wildcard CORS origin (*) allows all origins',
+                                                safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
+                                            },
+                                            suggest: [
+                                                {
+                                                    messageId: 'useOriginValidation',
+                                                    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                                    fix: (_fixer) => null,
+                                                },
+                                            ],
+                                        });
+                                    }
+                                }
+                            }
+                            else if (arg.type === 'Identifier') {
+                                // Check if this identifier was assigned an object literal with origin: "*"
+                                // For cases like: const config = { origin: "*" }; app.use(cors(config));
+                                const varName = arg.name;
+                                // Traverse the AST to find the variable declaration
+                                let current = node;
+                                while (current) {
+                                    if (current.type === 'Program' || current.type === 'FunctionDeclaration' || current.type === 'FunctionExpression' || current.type === 'ArrowFunctionExpression') {
+                                        // Search for variable declarations in this scope
+                                        const scopeBody = current.type === 'Program' ? current.body :
+                                            (current.type === 'FunctionDeclaration' || current.type === 'FunctionExpression' || current.type === 'ArrowFunctionExpression') ?
+                                                (current.body.type === 'BlockStatement' ? current.body.body : []) : [];
+                                        for (const stmt of scopeBody) {
+                                            if (stmt.type === 'VariableDeclaration') {
+                                                for (const declarator of stmt.declarations) {
+                                                    if (declarator.id.type === 'Identifier' && declarator.id.name === varName && declarator.init) {
+                                                        // Check if init is an object literal with origin: "*"
+                                                        if (declarator.init.type === 'ObjectExpression') {
+                                                            for (const prop of declarator.init.properties) {
+                                                                if (prop.type === 'Property' &&
+                                                                    prop.key.type === 'Identifier' &&
+                                                                    prop.key.name === 'origin' &&
+                                                                    prop.value.type === 'Literal' &&
+                                                                    prop.value.value === '*') {
+                                                                    context.report({
+                                                                        node: arg,
+                                                                        messageId: 'missingCorsCheck',
+                                                                        data: {
+                                                                            issue: 'Wildcard CORS origin (*) allows all origins',
+                                                                            safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
+                                                                        },
+                                                                        suggest: [
+                                                                            {
+                                                                                messageId: 'useOriginValidation',
+                                                                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                                                                fix: (_fixer) => null,
+                                                                            },
+                                                                        ],
+                                                                    });
+                                                                    return; // Found and reported, exit
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                        break; // Only check the immediate scope
+                                    }
+                                    if (current.parent) {
+                                        current = current.parent;
+                                    }
+                                    else {
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        function checkMemberExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for Access-Control-Allow-Origin header without validation
+            if (node.property.type === 'Identifier') {
+                const propertyName = node.property.name;
+                if (propertyName === 'setHeader' || propertyName === 'header') {
+                    // Check if it matches any ignore pattern
+                    const text = sourceCode.getText(node);
+                    if (matchesIgnorePattern(text, ignorePatterns)) {
+                        return;
+                    }
+                    // Check if it's setting CORS headers
+                    // Need to check the full call expression, not just the member expression
+                    const parent = node.parent;
+                    if (parent && parent.type === 'CallExpression') {
+                        const callText = sourceCode.getText(parent);
+                        if (/\bAccess-Control-Allow-Origin\b/i.test(callText)) {
+                            // Check if the value is a wildcard
+                            const args = parent.arguments;
+                            if (args.length >= 2 && args[1].type === 'Literal' && args[1].value === '*') {
+                                context.report({
+                                    node: args[1],
+                                    messageId: 'missingCorsCheck',
+                                    data: {
+                                        issue: 'Wildcard CORS header allows all origins',
+                                        safeAlternative: 'Validate origin before setting header: res.setHeader("Access-Control-Allow-Origin", allowedOrigins.includes(origin) ? origin : "null");',
+                                    },
+                                    suggest: [
+                                        {
+                                            messageId: 'useOriginValidation',
+                                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                            fix: (_fixer) => null,
+                                        },
+                                    ],
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        return {
+            Literal: checkLiteral,
+            CallExpression: checkCallExpression,
+            MemberExpression: checkMemberExpression,
+        };
+    },
+});
+//# sourceMappingURL=no-missing-cors-check.js.map

package/src/rules/security/no-missing-cors-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-missing-cors-check.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-missing-cors-check.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAiBtD;;;;;GAKG;AACH,6DAA6D;AAC7D,SAAS,kBAAkB,CACzB,IAAmB,EACnB,UAA+B,EAC/B,gBAA0B;IAE1B,IAAI,OAAO,GAAyB,IAAI,CAAC;IAEzC,OAAO,OAAO,EAAE,CAAC;QACf,kCAAkC;QAClC,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAE9B,uCAAuC;YACvC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC7C,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBACzE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3E,mDAAmD;gBACnD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,cAAwB;IAClE,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,kBAAkB,GAAG,IAAA,0BAAU,EAA0B;IACpE,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,uEAAuE;SACrF;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,yBAAyB;gBACpC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,sBAAsB;gBACnC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,sGAAsG;gBAC3G,iBAAiB,EAAE,yDAAyD;aAC7E,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2CAA2C;gBAChD,iBAAiB,EAAE,mCAAmC;aACvD,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,yCAAyC;qBACvD;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,2FAA2F;qBACzG;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,oCAAoC;qBAClD;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;YACnB,gBAAgB,EAAE,EAAE,EAAE,oEAAoE;YAC1F,cAAc,EAAE,EAAE;SACnB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,gBAAgB,EAAE,oBAAoB,GAAG,EAAE,EAC3C,cAAc,GAAG,EAAE,GACpB,GAAG,OAAkB,CAAC;QAEvB,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;QAE9C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAE5D,SAAS,YAAY,CAAC,IAAsB;YAC1C,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,iCAAiC;YACjC,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAEtC,yCAAyC;gBACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBAED,sDAAsD;gBACtD,kEAAkE;gBAClE,yFAAyF;gBACzF,IAAI,UAAU,GAAG,KAAK,CAAC;gBACvB,IAAI,OAAO,GAAyB,IAAI,CAAC;gBACzC,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjC,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;oBAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC7C,yEAAyE;wBACzE,kDAAkD;wBAClD,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACrG,UAAU,GAAG,IAAI,CAAC;4BAClB,MAAM;wBACR,CAAC;wBACD,oGAAoG;wBACpG,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAClE,+DAA+D;4BAC/D,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gCACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAA2B,CAAC;gCAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oCACjE,UAAU,GAAG,IAAI,CAAC;oCAClB,MAAM;gCACR,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,uDAAuD;gBACvD,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO;gBACT,CAAC;gBAED,0CAA0C;gBAC1C,kFAAkF;gBAClF,uCAAuC;gBACvC,IAAI,mBAAmB,GAAG,KAAK,CAAC;gBAEhC,iDAAiD;gBACjD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjC,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;oBAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC7C,uCAAuC;wBACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACzE,mBAAmB,GAAG,IAAI,CAAC;4BAC3B,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,kFAAkF;gBAClF,qDAAqD;gBACrD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAA2B,CAAC;oBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBAC5C,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;4BACzD,mDAAmD;4BACnD,IAAI,UAAU,GAAG,KAAK,CAAC;4BACvB,IAAI,SAAS,GAAyB,IAAI,CAAC;4BAC3C,OAAO,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gCACrC,SAAS,GAAG,SAAS,CAAC,MAAuB,CAAC;gCAC9C,IAAI,SAAS,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oCACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oCAC/C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;wCAC7B,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wCAC/D,UAAU,GAAG,IAAI,CAAC;wCAClB,MAAM;oCACR,CAAC;gCACH,CAAC;4BACH,CAAC;4BAED,IAAI,UAAU,EAAE,CAAC;gCACf,uDAAuD;gCACvD,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI;oCACJ,SAAS,EAAE,kBAAkB;oCAC7B,IAAI,EAAE;wCACJ,KAAK,EAAE,6CAA6C;wCACpD,eAAe,EAAE,oLAAoL;qCACtM;oCACD,OAAO,EAAE;wCACP;4CACE,SAAS,EAAE,qBAAqB;4CAChC,6DAA6D;4CAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;yCAC1C;qCACF;iCACF,CAAC,CAAC;gCACH,OAAO;4BACT,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gDAAgD;gBAChD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,uDAAuD;oBACvD,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,kBAAkB;wBAC7B,IAAI,EAAE;4BACJ,KAAK,EAAE,6CAA6C;4BACpD,eAAe,EAAE,oLAAoL;yBACtM;wBACD,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,qBAAqB;gCAChC,6DAA6D;gCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;6BAC1C;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,sDAAsD;YACtD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC9D,8BAA8B;oBAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAEtC,yCAAyC;oBACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;wBAC/C,OAAO;oBACT,CAAC;oBAED,uCAAuC;oBACvC,4CAA4C;oBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtE,IAAI,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,CAAC,UAAU,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC3G,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;wBAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBAC7C,iEAAiE;wBACjE,UAAU,GAAG,UAAU,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;4BAChE,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;wBAChD,CAAC,CAAC,CAAC;oBACL,CAAC;oBAED,+DAA+D;oBAC/D,IAAI,gBAAgB,GAAG,KAAK,CAAC;oBAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC5F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBACtD,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;oBAC1F,CAAC;oBAED,IAAI,gBAAgB,EAAE,CAAC;wBACrB,OAAO,CAAC,wBAAwB;oBAClC,CAAC;oBAED,4BAA4B;oBAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC5C,sCAAsC;wBACtC,8FAA8F;wBAC9F,MAAM,WAAW,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;wBACrF,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;wBAEzE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;4BAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gCACpC,gDAAgD;gCAChD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oCAClC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;wCACxB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;wCAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;wCAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;wCAC7B,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;wCAC7B,OAAO,CAAC,MAAM,CAAC;4CACb,IAAI,EAAE,IAAI,CAAC,KAAK;4CAChB,SAAS,EAAE,kBAAkB;4CAC7B,IAAI,EAAE;gDACJ,KAAK,EAAE,6CAA6C;gDACpD,eAAe,EAAE,oLAAoL;6CACtM;4CACD,OAAO,EAAE;gDACP;oDACE,SAAS,EAAE,qBAAqB;oDAChC,6DAA6D;oDAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;iDAC1C;6CACF;yCACF,CAAC,CAAC;oCACL,CAAC;gCACH,CAAC;4BACH,CAAC;iCAAM,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gCACrC,2EAA2E;gCAC3E,yEAAyE;gCACzE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;gCACzB,oDAAoD;gCACpD,IAAI,OAAO,GAAyB,IAAI,CAAC;gCACzC,OAAO,OAAO,EAAE,CAAC;oCACf,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;wCAChK,iDAAiD;wCACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4CAC5C,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC;gDACjI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wCAExF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;4CAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gDACxC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oDAC3C,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;wDAC7F,sDAAsD;wDACtD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;4DAChD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gEAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oEACxB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;oEAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;oEAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;oEAC7B,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;oEAC7B,OAAO,CAAC,MAAM,CAAC;wEACb,IAAI,EAAE,GAAG;wEACT,SAAS,EAAE,kBAAkB;wEAC7B,IAAI,EAAE;4EACJ,KAAK,EAAE,6CAA6C;4EACpD,eAAe,EAAE,oLAAoL;yEACtM;wEACD,OAAO,EAAE;4EACP;gFACE,SAAS,EAAE,qBAAqB;gFAChC,6DAA6D;gFAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;6EAC1C;yEACF;qEACF,CAAC,CAAC;oEACH,OAAO,CAAC,2BAA2B;gEACrC,CAAC;4DACH,CAAC;wDACH,CAAC;oDACH,CAAC;gDACH,CAAC;4CACH,CAAC;wCACH,CAAC;wCACD,MAAM,CAAC,iCAAiC;oCAC1C,CAAC;oCACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;wCACnB,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;oCAC5C,CAAC;yCAAM,CAAC;wCACN,MAAM;oCACR,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,qBAAqB,CAAC,IAA+B;YAC5D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,kEAAkE;YAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAExC,IAAI,YAAY,KAAK,WAAW,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;oBAC9D,yCAAyC;oBACzC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACtC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;wBAC/C,OAAO;oBACT,CAAC;oBAED,qCAAqC;oBACrC,yEAAyE;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBAC5C,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACtD,mCAAmC;4BACnC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;4BAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;gCAC5E,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;oCACb,SAAS,EAAE,kBAAkB;oCAC7B,IAAI,EAAE;wCACJ,KAAK,EAAE,yCAAyC;wCAChD,eAAe,EAAE,yIAAyI;qCAC3J;oCACD,OAAO,EAAE;wCACP;4CACE,SAAS,EAAE,qBAAqB;4CAChC,6DAA6D;4CAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;yCAC1C;qCACF;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-missing-csrf-protection.d.ts

@@ -0,0 +1,11 @@
+export interface Options {
+    /** Allow missing CSRF protection in test files. Default: false */
+    allowInTests?: boolean;
+    /** CSRF middleware patterns to recognize. Default: ['csrf', 'csurf', 'csrfProtection', 'verifyCsrfToken'] */
+    csrfMiddlewarePatterns?: string[];
+    /** HTTP methods that require CSRF protection. Default: ['post', 'put', 'delete', 'patch'] */
+    protectedMethods?: string[];
+    /** Additional safe patterns to ignore. Default: [] */
+    ignorePatterns?: string[];
+}
+export declare const noMissingCsrfProtection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;