eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-unvalidated-user-input.js

@@ -0,0 +1,418 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noUnvalidatedUserInput = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Patterns that indicate unvalidated user input
+ */
+const UNVALIDATED_INPUT_PATTERNS = [
+    // Express/Node.js patterns
+    { pattern: /\breq\.body\b/, name: 'req.body', context: 'Express request body' },
+    { pattern: /\breq\.query\b/, name: 'req.query', context: 'Express query parameters' },
+    { pattern: /\breq\.params\b/, name: 'req.params', context: 'Express route parameters' },
+    { pattern: /\breq\.headers\b/, name: 'req.headers', context: 'Express headers' },
+    { pattern: /\breq\.cookies\b/, name: 'req.cookies', context: 'Express cookies' },
+    // Fastify patterns
+    { pattern: /\brequest\.body\b/, name: 'request.body', context: 'Fastify request body' },
+    { pattern: /\brequest\.query\b/, name: 'request.query', context: 'Fastify query parameters' },
+    { pattern: /\brequest\.params\b/, name: 'request.params', context: 'Fastify route parameters' },
+    // Next.js patterns
+    { pattern: /\bsearchParams\b/, name: 'searchParams', context: 'Next.js search params' },
+    // Generic patterns
+    { pattern: /\buserInput\b/, name: 'userInput', context: 'Generic user input' },
+    { pattern: /\binput\b/, name: 'input', context: 'Generic input variable' },
+];
+/**
+ * Check if a node is inside a validation function call
+ */
+function isInsideValidationCall(node, sourceCode, trustedLibraries) {
+    let current = node;
+    while (current) {
+        // Check if current is an argument to a CallExpression
+        if (current.parent && current.parent.type === 'CallExpression') {
+            const callExpr = current.parent;
+            // Verify that current is actually an argument of this call
+            const isArgument = callExpr.arguments.some((arg) => arg === current);
+            if (!isArgument) {
+                // Not an argument, continue traversing
+                if ('parent' in current && current.parent) {
+                    current = current.parent;
+                    continue;
+                }
+                else {
+                    break;
+                }
+            }
+            const callee = callExpr.callee;
+            // Check if it's a validation library call (e.g., schema.parse(), schema.validate())
+            if (callee.type === 'MemberExpression') {
+                const property = callee.property;
+                if (property.type === 'Identifier') {
+                    const methodName = property.name.toLowerCase();
+                    // Check for validation methods (including async variants)
+                    // Note: safeParse is one word, not two
+                    if (['parse', 'validate', 'safeparse', 'parseasync', 'validateasync', 'safe_parse'].includes(methodName)) {
+                        return true;
+                    }
+                }
+                // Check if the object is a validation library
+                const object = callee.object;
+                if (object.type === 'Identifier') {
+                    const objectName = object.name.toLowerCase();
+                    if (trustedLibraries.some(lib => objectName.includes(lib.toLowerCase()))) {
+                        return true;
+                    }
+                }
+            }
+            // Check if it's a direct validation function call (e.g., validate(), plainToClass())
+            if (callee.type === 'Identifier') {
+                const calleeName = callee.name.toLowerCase();
+                if (['validate', 'plaintoclass', 'transform'].includes(calleeName)) {
+                    return true;
+                }
+                if (trustedLibraries.some(lib => calleeName.includes(lib.toLowerCase()))) {
+                    return true;
+                }
+            }
+        }
+        // Traverse up the AST
+        if ('parent' in current && current.parent) {
+            current = current.parent;
+        }
+        else {
+            break;
+        }
+    }
+    return false;
+}
+/**
+ * Check if a string matches any ignore pattern
+ */
+function matchesIgnorePattern(text, ignorePatterns) {
+    return ignorePatterns.some(pattern => {
+        try {
+            const regex = new RegExp(pattern, 'i');
+            return regex.test(text);
+        }
+        catch {
+            // Invalid regex - treat as literal string match
+            return text.toLowerCase().includes(pattern.toLowerCase());
+        }
+    });
+}
+exports.noUnvalidatedUserInput = (0, eslint_devkit_2.createRule)({
+    name: 'no-unvalidated-user-input',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects unvalidated user input usage (req.body, req.query, etc.)',
+        },
+        hasSuggestions: true,
+        messages: {
+            unvalidatedInput: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unvalidated User Input',
+                cwe: 'CWE-20',
+                description: 'Unvalidated user input detected: {{inputSource}}',
+                severity: 'HIGH',
+                fix: 'Use validation library: {{validationExample}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/20.html',
+            }),
+            useValidationLibrary: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Validation Library',
+                description: 'Use validation library',
+                severity: 'LOW',
+                fix: 'Use Zod, Joi, Yup, or class-validator',
+                documentationLink: 'https://zod.dev/',
+            }),
+            useZod: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Zod',
+                description: 'Use Zod for validation',
+                severity: 'LOW',
+                fix: 'const data = z.object({ name: z.string() }).parse(req.body)',
+                documentationLink: 'https://zod.dev/',
+            }),
+            useJoi: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Joi',
+                description: 'Use Joi for validation',
+                severity: 'LOW',
+                fix: 'Joi.object({ name: Joi.string() }).validate(req.body)',
+                documentationLink: 'https://joi.dev/',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow unvalidated input in test files',
+                    },
+                    trustedLibraries: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['zod', 'joi', 'yup', 'class-validator'],
+                        description: 'Trusted validation libraries',
+                    },
+                    ignorePatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional safe patterns to ignore',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            trustedLibraries: ['zod', 'joi', 'yup', 'class-validator'],
+            ignorePatterns: [],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false, trustedLibraries = ['zod', 'joi', 'yup', 'class-validator'], ignorePatterns = [], } = options;
+        const filename = context.getFilename();
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        const sourceCode = context.sourceCode || context.sourceCode;
+        function checkMemberExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            const text = sourceCode.getText(node);
+            // Check if the variable name (if in assignment) matches ignore pattern
+            // For cases like: const safeInput = req.body;
+            if (node.parent && node.parent.type === 'VariableDeclarator' && node.parent.id.type === 'Identifier') {
+                const varName = node.parent.id.name;
+                if (matchesIgnorePattern(varName, ignorePatterns)) {
+                    return;
+                }
+            }
+            // Check if it matches any ignore pattern
+            if (matchesIgnorePattern(text, ignorePatterns)) {
+                return;
+            }
+            // Check if it matches unvalidated input patterns
+            // For nested member expressions like req.body.name, check the base (req.body)
+            let baseText = text;
+            if (node.object.type === 'MemberExpression') {
+                baseText = sourceCode.getText(node.object);
+            }
+            const matchedPattern = UNVALIDATED_INPUT_PATTERNS.find(p => p.pattern.test(text) || p.pattern.test(baseText));
+            if (matchedPattern) {
+                // Skip if this is a nested member expression and the parent also matches
+                // This prevents double reporting for cases like req.query.id
+                // We only want to report on the outermost matching expression
+                if (node.object.type === 'MemberExpression') {
+                    const parentText = sourceCode.getText(node.object);
+                    const parentMatches = UNVALIDATED_INPUT_PATTERNS.some(p => p.pattern.test(parentText));
+                    if (parentMatches) {
+                        // Parent also matches, skip this nested one - it will be reported when we visit the parent
+                        return;
+                    }
+                }
+                // Skip if this is in a destructuring assignment - checkObjectPattern will handle it
+                // This prevents double reporting for cases like: const { email } = req.body;
+                if (node.parent && node.parent.type === 'VariableDeclarator' && node.parent.id.type === 'ObjectPattern') {
+                    return; // checkObjectPattern will report on the init instead
+                }
+                // Check if it's inside a validation call
+                if (isInsideValidationCall(node, sourceCode, trustedLibraries)) {
+                    return;
+                }
+                // Determine validation example based on context
+                let validationExample = 'const schema = z.object({ field: z.string() }); const data = schema.parse(req.body);';
+                if (text.includes('query')) {
+                    validationExample = 'const schema = z.object({ id: z.string() }); const data = schema.parse(req.query);';
+                }
+                else if (text.includes('params')) {
+                    validationExample = 'const schema = z.object({ id: z.string() }); const data = schema.parse(req.params);';
+                }
+                // Build suggestions - provide same code as output for test framework recognition
+                const suggestions = [
+                    {
+                        messageId: 'useZod',
+                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                        fix: (_fixer) => {
+                            // This is a suggestion, not an auto-fix, so we return null
+                            return null;
+                        },
+                    },
+                    {
+                        messageId: 'useJoi',
+                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                        fix: (_fixer) => {
+                            return null;
+                        },
+                    },
+                ];
+                context.report({
+                    node,
+                    messageId: 'unvalidatedInput',
+                    data: {
+                        inputSource: matchedPattern.name,
+                        validationExample,
+                    },
+                    suggest: suggestions,
+                });
+            }
+        }
+        function checkIdentifier(node) {
+            if (isTestFile) {
+                return;
+            }
+            const text = node.name;
+            // Check if it matches any ignore pattern
+            if (matchesIgnorePattern(text, ignorePatterns)) {
+                return;
+            }
+            // Skip if this identifier is assigned from a user input source (MemberExpression)
+            // For cases like: const userInput = req.body;
+            // We should only report on req.body, not on userInput
+            // But don't skip if the init is the same identifier (e.g., const data = input;)
+            if (node.parent && node.parent.type === 'VariableDeclarator' && node.parent.init) {
+                const init = node.parent.init;
+                // Only skip if init is a MemberExpression (like req.body) that will be caught by checkMemberExpression
+                // Don't skip if init is the same identifier (like input) - we want to report on it
+                if (init.type === 'MemberExpression') {
+                    const initText = sourceCode.getText(init);
+                    // Check if init matches any user input pattern
+                    const initMatchesPattern = UNVALIDATED_INPUT_PATTERNS.some(p => p.pattern.test(initText));
+                    if (initMatchesPattern) {
+                        return; // Skip - the init (e.g., req.body) will be reported by checkMemberExpression
+                    }
+                }
+            }
+            // Check for generic input patterns (userInput, input)
+            const matchedPattern = UNVALIDATED_INPUT_PATTERNS.find(p => (p.name === 'userInput' || p.name === 'input') && p.pattern.test(text));
+            if (matchedPattern) {
+                // Check if it's inside a validation call
+                if (isInsideValidationCall(node, sourceCode, trustedLibraries)) {
+                    return;
+                }
+                context.report({
+                    node,
+                    messageId: 'unvalidatedInput',
+                    data: {
+                        inputSource: matchedPattern.name,
+                        validationExample: 'const schema = z.object({ field: z.string() }); const data = schema.parse(input);',
+                    },
+                    suggest: [
+                        {
+                            messageId: 'useZod',
+                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                            fix: (_fixer) => null,
+                        },
+                        {
+                            messageId: 'useJoi',
+                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                            fix: (_fixer) => null,
+                        },
+                    ],
+                });
+            }
+        }
+        function checkObjectPattern(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check destructuring patterns like: const { page, limit } = req.query;
+            if (node.parent && node.parent.type === 'VariableDeclarator' && node.parent.init) {
+                const init = node.parent.init;
+                const initText = sourceCode.getText(init);
+                // If init is a CallExpression, check if it's a validation call
+                // If so, the input is being validated, so skip
+                if (init.type === 'CallExpression') {
+                    const callee = init.callee;
+                    if (callee.type === 'MemberExpression' && callee.property.type === 'Identifier') {
+                        const methodName = callee.property.name.toLowerCase();
+                        if (['parse', 'validate', 'safeparse', 'parseasync', 'validateasync', 'safe_parse'].includes(methodName)) {
+                            return; // It's a validation call, skip
+                        }
+                    }
+                    if (callee.type === 'Identifier') {
+                        const calleeName = callee.name.toLowerCase();
+                        if (['validate', 'plaintoclass', 'transform'].includes(calleeName)) {
+                            return; // It's a validation call, skip
+                        }
+                    }
+                }
+                // Check if the right side matches unvalidated input patterns
+                const matchedPattern = UNVALIDATED_INPUT_PATTERNS.find(p => p.pattern.test(initText));
+                if (matchedPattern) {
+                    // For CallExpressions, check the arguments to see if they're validated
+                    // The init itself being a validation call was already checked above
+                    if (init.type === 'CallExpression') {
+                        // Check each argument to see if it's validated
+                        // If init is a validation call (like schema.validate(req.body)),
+                        // then req.body is validated, so skip
+                        const callee = init.callee;
+                        const isValidationCall = (callee.type === 'MemberExpression' && callee.property.type === 'Identifier' &&
+                            ['parse', 'validate', 'safeparse', 'parseasync', 'validateasync', 'safe_parse'].includes(callee.property.name.toLowerCase())) ||
+                            (callee.type === 'Identifier' &&
+                                ['validate', 'plaintoclass', 'transform'].includes(callee.name.toLowerCase()));
+                        if (isValidationCall) {
+                            return; // The init is a validation call, so the input is validated
+                        }
+                        // If init is not a validation call, check if arguments are validated
+                        const hasValidatedArg = init.arguments.some((arg) => {
+                            if (arg.type === 'MemberExpression' || arg.type === 'Identifier') {
+                                return isInsideValidationCall(arg, sourceCode, trustedLibraries);
+                            }
+                            return false;
+                        });
+                        if (hasValidatedArg) {
+                            return; // At least one argument is validated
+                        }
+                    }
+                    else {
+                        // For non-call expressions, check if init itself is inside a validation call
+                        if (isInsideValidationCall(init, sourceCode, trustedLibraries)) {
+                            return;
+                        }
+                    }
+                    // Check if variable name matches ignore pattern
+                    if (node.parent.id.type === 'ObjectPattern') {
+                        const varText = sourceCode.getText(node.parent.id);
+                        if (matchesIgnorePattern(varText, ignorePatterns)) {
+                            return;
+                        }
+                    }
+                    context.report({
+                        node: init,
+                        messageId: 'unvalidatedInput',
+                        data: {
+                            inputSource: matchedPattern.name,
+                            validationExample: 'const schema = z.object({ page: z.string(), limit: z.string() }); const { page, limit } = schema.parse(req.query);',
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useZod',
+                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                fix: (_fixer) => null,
+                            },
+                            {
+                                messageId: 'useJoi',
+                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                                fix: (_fixer) => null,
+                            },
+                        ],
+                    });
+                }
+            }
+        }
+        return {
+            MemberExpression: checkMemberExpression,
+            Identifier: checkIdentifier,
+            ObjectPattern: checkObjectPattern,
+        };
+    },
+});
+//# sourceMappingURL=no-unvalidated-user-input.js.map

package/src/rules/security/no-unvalidated-user-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unvalidated-user-input.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-unvalidated-user-input.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAiBtD;;GAEG;AACH,MAAM,0BAA0B,GAAG;IACjC,2BAA2B;IAC3B,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE;IAC/E,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACrF,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACvF,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAChF,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAEhF,mBAAmB;IACnB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACvF,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC7F,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAE/F,mBAAmB;IACnB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAEvF,mBAAmB;IACnB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,EAAE;IAC9E,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAC3E,CAAC;AAEF;;GAEG;AACH,SAAS,sBAAsB,CAC7B,IAAmB,EACnB,UAA+B,EAC/B,gBAA0B;IAE1B,IAAI,OAAO,GAAyB,IAAI,CAAC;IAEzC,OAAO,OAAO,EAAE,CAAC;QACf,sDAAsD;QACtD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAiC,CAAC;YAE3D,2DAA2D;YAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAoC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACtG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,uCAAuC;gBACvC,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;oBAC1C,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAE/B,oFAAoF;YACpF,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/C,0DAA0D;oBAC1D,uCAAuC;oBACvC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACzG,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,8CAA8C;gBAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC7C,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBACzE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qFAAqF;YACrF,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnE,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;oBACzE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,cAAwB;IAClE,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,sBAAsB,GAAG,IAAA,0BAAU,EAA0B;IACxE,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,kEAAkE;SAChF;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wBAAwB;gBACnC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,kDAAkD;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,gDAAgD;aACpE,CAAC;YACF,oBAAoB,EAAE,IAAA,gCAAgB,EAAC;gBACrC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uCAAuC;gBAC5C,iBAAiB,EAAE,kBAAkB;aACtC,CAAC;YACF,MAAM,EAAE,IAAA,gCAAgB,EAAC;gBACvB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,6DAA6D;gBAClE,iBAAiB,EAAE,kBAAkB;aACtC,CAAC;YACF,MAAM,EAAE,IAAA,gCAAgB,EAAC;gBACvB,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,kBAAkB;aACtC,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,uCAAuC;qBACrD;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC;wBACjD,WAAW,EAAE,8BAA8B;qBAC5C;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,oCAAoC;qBAClD;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;YACnB,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC;YAC1D,cAAc,EAAE,EAAE;SACnB;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAC3D,cAAc,GAAG,EAAE,GACpB,GAAG,OAAkB,CAAC;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAE5D,SAAS,qBAAqB,CAAC,IAA+B;YAC5D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEtC,uEAAuE;YACvE,8CAA8C;YAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACrG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;gBACpC,IAAI,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;oBAClD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,yCAAyC;YACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,iDAAiD;YACjD,8EAA8E;YAC9E,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CACjD,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,6DAA6D;gBAC7D,8DAA8D;gBAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;oBACvF,IAAI,aAAa,EAAE,CAAC;wBAClB,2FAA2F;wBAC3F,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,oFAAoF;gBACpF,6EAA6E;gBAC7E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACxG,OAAO,CAAC,qDAAqD;gBAC/D,CAAC;gBAED,yCAAyC;gBACzC,IAAI,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,gDAAgD;gBAChD,IAAI,iBAAiB,GAAG,sFAAsF,CAAC;gBAC/G,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,iBAAiB,GAAG,oFAAoF,CAAC;gBAC3G,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnC,iBAAiB,GAAG,qFAAqF,CAAC;gBAC5G,CAAC;gBAED,iFAAiF;gBACjF,MAAM,WAAW,GAAsD;oBACrE;wBACE,SAAS,EAAE,QAAQ;wBACnB,6DAA6D;wBAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE;4BAClC,2DAA2D;4BAC3D,OAAO,IAAI,CAAC;wBACd,CAAC;qBACF;oBACD;wBACE,SAAS,EAAE,QAAQ;wBACnB,6DAA6D;wBAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE;4BAClC,OAAO,IAAI,CAAC;wBACd,CAAC;qBACF;iBACF,CAAC;gBAEF,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,kBAAkB;oBAC7B,IAAI,EAAE;wBACJ,WAAW,EAAE,cAAc,CAAC,IAAI;wBAChC,iBAAiB;qBAClB;oBACD,OAAO,EAAE,WAAW;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,SAAS,eAAe,CAAC,IAAyB;YAChD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAEvB,yCAAyC;YACzC,IAAI,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,8CAA8C;YAC9C,sDAAsD;YACtD,gFAAgF;YAChF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC9B,uGAAuG;gBACvG,mFAAmF;gBACnF,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1C,+CAA+C;oBAC/C,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC1F,IAAI,kBAAkB,EAAE,CAAC;wBACvB,OAAO,CAAC,6EAA6E;oBACvF,CAAC;gBACH,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACvE,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,yCAAyC;gBACzC,IAAI,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,kBAAkB;oBAC7B,IAAI,EAAE;wBACJ,WAAW,EAAE,cAAc,CAAC,IAAI;wBAChC,iBAAiB,EAAE,mFAAmF;qBACvG;oBACD,OAAO,EAAE;wBACP;4BACE,SAAS,EAAE,QAAQ;4BACnB,6DAA6D;4BAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;yBAC1C;wBACD;4BACE,SAAS,EAAE,QAAQ;4BACnB,6DAA6D;4BAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;yBAC1C;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,SAAS,kBAAkB,CAAC,IAA4B;YACtD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAE1C,+DAA+D;gBAC/D,+CAA+C;gBAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAChF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBACtD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BACzG,OAAO,CAAC,+BAA+B;wBACzC,CAAC;oBACH,CAAC;oBACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACjC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;wBAC7C,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;4BACnE,OAAO,CAAC,+BAA+B;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,6DAA6D;gBAC7D,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAEtF,IAAI,cAAc,EAAE,CAAC;oBACnB,uEAAuE;oBACvE,oEAAoE;oBACpE,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACnC,+CAA+C;wBAC/C,iEAAiE;wBACjE,sCAAsC;wBACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;wBAC3B,MAAM,gBAAgB,GACpB,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;4BAC3E,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;4BAC9H,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gCAC5B,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;wBAElF,IAAI,gBAAgB,EAAE,CAAC;4BACrB,OAAO,CAAC,2DAA2D;wBACrE,CAAC;wBAED,qEAAqE;wBACrE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAoC,EAAE,EAAE;4BACnF,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gCACjE,OAAO,sBAAsB,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;4BACnE,CAAC;4BACD,OAAO,KAAK,CAAC;wBACf,CAAC,CAAC,CAAC;wBACH,IAAI,eAAe,EAAE,CAAC;4BACpB,OAAO,CAAC,qCAAqC;wBAC/C,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,6EAA6E;wBAC7E,IAAI,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,CAAC;4BAC/D,OAAO;wBACT,CAAC;oBACH,CAAC;oBAED,gDAAgD;oBAChD,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;wBAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;wBACnD,IAAI,oBAAoB,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;4BAClD,OAAO;wBACT,CAAC;oBACH,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,kBAAkB;wBAC7B,IAAI,EAAE;4BACJ,WAAW,EAAE,cAAc,CAAC,IAAI;4BAChC,iBAAiB,EAAE,oHAAoH;yBACxI;wBACD,OAAO,EAAE;4BACP;gCACE,SAAS,EAAE,QAAQ;gCACnB,6DAA6D;gCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;6BAC1C;4BACD;gCACE,SAAS,EAAE,QAAQ;gCACnB,6DAA6D;gCAC7D,GAAG,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,IAAI;6BAC1C;yBACF;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,gBAAgB,EAAE,qBAAqB;YACvC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,kBAAkB;SAClC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-weak-crypto.d.ts

@@ -0,0 +1,11 @@
+export interface Options {
+    /** Allow weak crypto in test files. Default: false */
+    allowInTests?: boolean;
+    /** Additional weak algorithms to detect. Default: [] */
+    additionalWeakAlgorithms?: string[];
+    /** Trusted crypto libraries. Default: ['crypto', 'crypto-js'] */
+    trustedLibraries?: string[];
+    /** Strategy for fixing weak crypto: 'upgrade', 'migrate', 'policy', 'auto' */
+    strategy?: 'upgrade' | 'migrate' | 'policy' | 'auto';
+}
+export declare const noWeakCrypto: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;