eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-weak-crypto.js

@@ -0,0 +1,350 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noWeakCrypto = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const WEAK_CRYPTO_PATTERNS = [
+    {
+        pattern: /\bmd5\b/i,
+        name: 'MD5',
+        category: 'hash',
+        alternatives: ['SHA-256', 'SHA-512', 'SHA-3'],
+        example: {
+            bad: 'crypto.createHash("md5").update(data)',
+            good: 'crypto.createHash("sha256").update(data)'
+        },
+        effort: '5 minutes'
+    },
+    {
+        pattern: /\bsha1\b/i,
+        name: 'SHA-1',
+        category: 'hash',
+        alternatives: ['SHA-256', 'SHA-512', 'SHA-3'],
+        example: {
+            bad: 'crypto.createHash("sha1").update(data)',
+            good: 'crypto.createHash("sha256").update(data)'
+        },
+        effort: '5 minutes'
+    },
+    {
+        pattern: /\bdes\b/i,
+        name: 'DES',
+        category: 'encryption',
+        alternatives: ['AES-256', 'ChaCha20-Poly1305'],
+        example: {
+            bad: 'crypto.createCipher("des", key)',
+            good: 'crypto.createCipheriv("aes-256-gcm", key, iv)'
+        },
+        effort: '15 minutes'
+    },
+    {
+        pattern: /\b3des\b|\btripledes\b/i,
+        name: '3DES',
+        category: 'encryption',
+        alternatives: ['AES-256', 'ChaCha20-Poly1305'],
+        example: {
+            bad: 'crypto.createCipher("des-ede3", key)',
+            good: 'crypto.createCipheriv("aes-256-gcm", key, iv)'
+        },
+        effort: '15 minutes'
+    },
+    {
+        pattern: /\brc4\b/i,
+        name: 'RC4',
+        category: 'encryption',
+        alternatives: ['AES-256', 'ChaCha20-Poly1305'],
+        example: {
+            bad: 'crypto.createCipher("rc4", key)',
+            good: 'crypto.createCipheriv("aes-256-gcm", key, iv)'
+        },
+        effort: '15 minutes'
+    }
+];
+/**
+ * Check if a string contains a weak crypto algorithm
+ */
+function containsWeakCrypto(value, additionalPatterns) {
+    // Check standard patterns
+    for (const pattern of WEAK_CRYPTO_PATTERNS) {
+        if (pattern.pattern.test(value)) {
+            return pattern;
+        }
+    }
+    // Check additional patterns
+    for (const additionalPattern of additionalPatterns) {
+        const regex = new RegExp(`\\b${additionalPattern}\\b`, 'i');
+        if (regex.test(value)) {
+            return {
+                pattern: regex,
+                name: additionalPattern,
+                category: 'hash',
+                alternatives: ['SHA-256', 'SHA-512'],
+                example: {
+                    bad: `crypto.createHash("${additionalPattern}").update(data)`,
+                    good: 'crypto.createHash("sha256").update(data)'
+                },
+                effort: '10 minutes'
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Generate refactoring suggestions based on the weak crypto pattern
+ */
+function generateRefactoringSteps(pattern, context) {
+    const suggestions = [];
+    if (pattern.category === 'hash') {
+        suggestions.push({
+            messageId: 'useSha256',
+            fix: `Use SHA-256: crypto.createHash("sha256").update(${context})`
+        });
+    }
+    else if (pattern.category === 'encryption') {
+        suggestions.push({
+            messageId: 'useAes256',
+            fix: `Use AES-256-GCM: crypto.createCipheriv("aes-256-gcm", key, iv)`
+        });
+    }
+    if (pattern.category === 'password') {
+        suggestions.push({
+            messageId: 'useBcrypt',
+            fix: 'Use bcrypt: bcrypt.hash(password, 10)'
+        });
+        suggestions.push({
+            messageId: 'useScrypt',
+            fix: 'Use scrypt: crypto.scrypt(password, salt, 64)'
+        });
+        suggestions.push({
+            messageId: 'useArgon2',
+            fix: 'Use Argon2: argon2.hash(password)'
+        });
+    }
+    return suggestions;
+}
+exports.noWeakCrypto = (0, eslint_devkit_2.createRule)({
+    name: 'no-weak-crypto',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects use of weak cryptography algorithms (MD5, SHA1, DES)',
+        },
+        hasSuggestions: true,
+        messages: {
+            weakCrypto: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Weak cryptography',
+                cwe: 'CWE-327',
+                description: 'Use of weak cryptography algorithm: {{algorithm}}',
+                severity: 'CRITICAL',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
+            }),
+            useSha256: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use SHA-256',
+                description: 'Use SHA-256 for hashing',
+                severity: 'LOW',
+                fix: 'crypto.createHash("sha256").update(data)',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatehashmethod-options',
+            }),
+            useBcrypt: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use bcrypt',
+                description: 'Use bcrypt for password hashing',
+                severity: 'LOW',
+                fix: 'bcrypt.hash(password, 10)',
+                documentationLink: 'https://github.com/kelektiv/node.bcrypt.js',
+            }),
+            useScrypt: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use scrypt',
+                description: 'Use scrypt for password hashing',
+                severity: 'LOW',
+                fix: 'crypto.scrypt(password, salt, 64)',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptoscryptpassword-salt-keylen-options-callback',
+            }),
+            useArgon2: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Argon2',
+                description: 'Use Argon2 for password hashing',
+                severity: 'LOW',
+                fix: 'argon2.hash(password)',
+                documentationLink: 'https://github.com/ranisalt/node-argon2',
+            }),
+            useAes256: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use AES-256-GCM',
+                description: 'Use AES-256-GCM for encryption',
+                severity: 'LOW',
+                fix: 'Use crypto.createCipheriv("aes-256-gcm", key, iv)',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
+            }),
+            strategyAuto: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Auto-fix Strategy',
+                description: 'Automatically suggest the best replacement',
+                severity: 'LOW',
+                fix: 'Apply automatic fix suggestion',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
+            }),
+            strategyUpgrade: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Upgrade Strategy',
+                description: 'Upgrade to a stronger algorithm',
+                severity: 'LOW',
+                fix: 'Replace weak algorithm with stronger alternative',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
+            }),
+            strategyMigrate: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Migration Strategy',
+                description: 'Plan migration to stronger cryptography',
+                severity: 'LOW',
+                fix: 'Create migration plan for cryptographic upgrade',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Weak_Cryptography',
+            }),
+            strategyPolicy: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Policy Strategy',
+                description: 'Apply organizational security policy',
+                severity: 'LOW',
+                fix: 'crypto.createCipheriv("aes-256-gcm", key, iv)',
+                documentationLink: 'https://nodejs.org/api/crypto.html#cryptocreatecipherivalgorithm-key-iv-options',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowInTests: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow weak crypto in test files',
+                    },
+                    additionalWeakAlgorithms: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional weak algorithms to detect',
+                    },
+                    trustedLibraries: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['crypto', 'crypto-js'],
+                        description: 'Trusted crypto libraries',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowInTests: false,
+            additionalWeakAlgorithms: [],
+            trustedLibraries: ['crypto', 'crypto-js'],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { allowInTests = false, additionalWeakAlgorithms = [], trustedLibraries = ['crypto', 'crypto-js'], } = options;
+        const filename = context.getFilename();
+        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        /**
+         * Check if a call expression uses weak crypto
+         */
+        function checkCallExpression(node) {
+            if (isTestFile) {
+                return;
+            }
+            // Check for crypto.createHash, crypto.createCipher, etc.
+            if (node.callee.type === 'MemberExpression') {
+                // Check if it's a crypto method call (e.g., crypto.createHash, crypto.createCipher)
+                if (node.callee.object.type === 'Identifier' &&
+                    node.callee.property.type === 'Identifier') {
+                    const objectName = node.callee.object.name;
+                    const methodName = node.callee.property.name;
+                    // Check if it's a crypto method from a trusted library
+                    const isCryptoMethod = (methodName === 'createHash' ||
+                        methodName === 'createCipher' ||
+                        methodName === 'createCipheriv') &&
+                        (trustedLibraries.includes(objectName) || objectName === 'crypto');
+                    if (isCryptoMethod) {
+                        // Check arguments for weak algorithms
+                        for (const arg of node.arguments) {
+                            if (arg.type === 'Literal' && typeof arg.value === 'string') {
+                                const weakPattern = containsWeakCrypto(arg.value, additionalWeakAlgorithms);
+                                if (weakPattern) {
+                                    const safeAlternative = weakPattern.alternatives[0];
+                                    const refactoringSteps = generateRefactoringSteps(weakPattern, 'data');
+                                    context.report({
+                                        node: arg,
+                                        messageId: 'weakCrypto',
+                                        data: {
+                                            algorithm: weakPattern.name,
+                                            safeAlternative: `Use ${safeAlternative}: ${weakPattern.example.good}`,
+                                        },
+                                        suggest: refactoringSteps.map(step => ({
+                                            messageId: step.messageId,
+                                            fix: (fixer) => {
+                                                // Replace the weak algorithm with a safe one
+                                                if (weakPattern.category === 'hash') {
+                                                    return fixer.replaceText(arg, `"sha256"`);
+                                                }
+                                                else if (weakPattern.category === 'encryption') {
+                                                    return fixer.replaceText(arg, `"aes-256-gcm"`);
+                                                }
+                                                return null;
+                                            },
+                                        })),
+                                    });
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Check for standalone crypto function calls (e.g., createHash, createCipher)
+            if (node.callee.type === 'Identifier') {
+                const calleeName = node.callee.name;
+                // Check for common crypto library patterns
+                if (calleeName === 'createHash' || calleeName === 'createCipher' || calleeName === 'createCipheriv') {
+                    for (const arg of node.arguments) {
+                        if (arg.type === 'Literal' && typeof arg.value === 'string') {
+                            const weakPattern = containsWeakCrypto(arg.value, additionalWeakAlgorithms);
+                            if (weakPattern) {
+                                const safeAlternative = weakPattern.alternatives[0];
+                                context.report({
+                                    node: arg,
+                                    messageId: 'weakCrypto',
+                                    data: {
+                                        algorithm: weakPattern.name,
+                                        safeAlternative: `Use ${safeAlternative}: ${weakPattern.example.good}`,
+                                    },
+                                    suggest: [
+                                        {
+                                            messageId: weakPattern.category === 'hash' ? 'useSha256' : 'useAes256',
+                                            fix: (fixer) => {
+                                                if (weakPattern.category === 'hash') {
+                                                    return fixer.replaceText(arg, `"sha256"`);
+                                                }
+                                                else if (weakPattern.category === 'encryption') {
+                                                    return fixer.replaceText(arg, `"aes-256-gcm"`);
+                                                }
+                                                return null;
+                                            },
+                                        },
+                                    ],
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        return {
+            CallExpression: checkCallExpression,
+        };
+    },
+});
+//# sourceMappingURL=no-weak-crypto.js.map

package/src/rules/security/no-weak-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-weak-crypto.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-weak-crypto.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAgDtD,MAAM,oBAAoB,GAAwB;IAChD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC7C,OAAO,EAAE;YACP,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,0CAA0C;SACjD;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC7C,OAAO,EAAE;YACP,GAAG,EAAE,wCAAwC;YAC7C,IAAI,EAAE,0CAA0C;SACjD;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC9C,OAAO,EAAE;YACP,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,+CAA+C;SACtD;QACD,MAAM,EAAE,YAAY;KACrB;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC9C,OAAO,EAAE;YACP,GAAG,EAAE,sCAAsC;YAC3C,IAAI,EAAE,+CAA+C;SACtD;QACD,MAAM,EAAE,YAAY;KACrB;IACD;QACE,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC9C,OAAO,EAAE;YACP,GAAG,EAAE,iCAAiC;YACtC,IAAI,EAAE,+CAA+C;SACtD;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,kBAAkB,CACzB,KAAa,EACb,kBAA4B;IAE5B,0BAA0B;IAC1B,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,iBAAiB,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;gBACpC,OAAO,EAAE;oBACP,GAAG,EAAE,sBAAsB,iBAAiB,iBAAiB;oBAC7D,IAAI,EAAE,0CAA0C;iBACjD;gBACD,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAC/B,OAA0B,EAC1B,OAAe;IAEf,MAAM,WAAW,GAA6C,EAAE,CAAC;IAEjE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,WAAW;YACtB,GAAG,EAAE,mDAAmD,OAAO,GAAG;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC7C,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,WAAW;YACtB,GAAG,EAAE,gEAAgE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACpC,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,WAAW;YACtB,GAAG,EAAE,uCAAuC;SAC7C,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,WAAW;YACtB,GAAG,EAAE,+CAA+C;SACrD,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,WAAW;YACtB,GAAG,EAAE,mCAAmC;SACzC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAEY,QAAA,YAAY,GAAG,IAAA,0BAAU,EAA0B;IAC9D,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,8DAA8D;SAC5E;QACD,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,UAAU,EAAE,IAAA,gCAAgB,EAAC;gBAC3B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,mDAAmD;gBAChE,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,yBAAyB;gBACtC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2BAA2B;gBAChC,iBAAiB,EAAE,4CAA4C;aAChE,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uBAAuB;gBAC5B,iBAAiB,EAAE,yCAAyC;aAC7D,CAAC;YACF,SAAS,EAAE,IAAA,gCAAgB,EAAC;gBAC1B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,gCAAgC;gBACrC,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,mEAAmE;aACvF,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,sCAAsC;gBACnD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,iFAAiF;aACrG,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,iCAAiC;qBAC/C;oBACD,wBAAwB,EAAE;wBACxB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,sCAAsC;qBACpD;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;wBAChC,WAAW,EAAE,0BAA0B;qBACxC;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,YAAY,EAAE,KAAK;YACnB,wBAAwB,EAAE,EAAE;YAC5B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC1C;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,GAAG,EAAE,CAAC;QAEd,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,wBAAwB,GAAG,EAAE,EAC7B,gBAAgB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,GAC3C,GAAG,OAAkB,CAAC;QAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpF;;WAEG;QACH,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,oFAAoF;gBACpF,IACE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAC1C,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAE7C,uDAAuD;oBACvD,MAAM,cAAc,GAClB,CAAC,UAAU,KAAK,YAAY;wBAC1B,UAAU,KAAK,cAAc;wBAC7B,UAAU,KAAK,gBAAgB,CAAC;wBAClC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,QAAQ,CAAC,CAAC;oBAErE,IAAI,cAAc,EAAE,CAAC;wBACnB,sCAAsC;wBACtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;4BACjC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCAC5D,MAAM,WAAW,GAAG,kBAAkB,CACpC,GAAG,CAAC,KAAK,EACT,wBAAwB,CACzB,CAAC;gCAEF,IAAI,WAAW,EAAE,CAAC;oCAChB,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oCACpD,MAAM,gBAAgB,GAAG,wBAAwB,CAC/C,WAAW,EACX,MAAM,CACP,CAAC;oCAEF,OAAO,CAAC,MAAM,CAAC;wCACb,IAAI,EAAE,GAAG;wCACT,SAAS,EAAE,YAAY;wCACvB,IAAI,EAAE;4CACJ,SAAS,EAAE,WAAW,CAAC,IAAI;4CAC3B,eAAe,EAAE,OAAO,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE;yCACvE;wCACD,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4CACrC,SAAS,EAAE,IAAI,CAAC,SAAS;4CACzB,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gDACjC,6CAA6C;gDAC7C,IAAI,WAAW,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oDACpC,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gDAC5C,CAAC;qDAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oDACjD,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gDACjD,CAAC;gDACD,OAAO,IAAI,CAAC;4CACd,CAAC;yCACF,CAAC,CAAC;qCACJ,CAAC,CAAC;gCACL,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,8EAA8E;YAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAEpC,2CAA2C;gBAC3C,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;oBACpG,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BAC5D,MAAM,WAAW,GAAG,kBAAkB,CACpC,GAAG,CAAC,KAAK,EACT,wBAAwB,CACzB,CAAC;4BAEF,IAAI,WAAW,EAAE,CAAC;gCAChB,MAAM,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gCAEpD,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI,EAAE,GAAG;oCACT,SAAS,EAAE,YAAY;oCACvB,IAAI,EAAE;wCACJ,SAAS,EAAE,WAAW,CAAC,IAAI;wCAC3B,eAAe,EAAE,OAAO,eAAe,KAAK,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE;qCACvE;oCACD,OAAO,EAAE;wCACP;4CACE,SAAS,EAAE,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;4CACtE,GAAG,EAAE,CAAC,KAAyB,EAAE,EAAE;gDACjC,IAAI,WAAW,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oDACpC,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gDAC5C,CAAC;qDAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oDACjD,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gDACjD,CAAC;gDACD,OAAO,IAAI,CAAC;4CACd,CAAC;yCACF;qCACF;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,cAAc,EAAE,mBAAmB;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-weak-password-recovery.d.ts

@@ -0,0 +1,12 @@
+import { type SecurityRuleOptions } from '@interlace/eslint-devkit';
+export interface Options extends SecurityRuleOptions {
+    /** Minimum token entropy bits */
+    minTokenEntropy?: number;
+    /** Maximum token lifetime in hours */
+    maxTokenLifetimeHours?: number;
+    /** Recovery-related keywords */
+    recoveryKeywords?: string[];
+    /** Secure token generation functions */
+    secureTokenFunctions?: string[];
+}
+export declare const noWeakPasswordRecovery: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;