eslint-plugin-secure-coding 1.0.0

package/src/rules/security/database-injection.js

@@ -0,0 +1,407 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.databaseInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+exports.databaseInjection = (0, eslint_devkit_2.createRule)({
+    name: 'database-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects SQL and NoSQL injection vulnerabilities with framework-specific fixes',
+        },
+        messages: (() => {
+            const databaseInjection = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'SQL Injection',
+                cwe: 'CWE-89',
+                description: 'SQL Injection detected',
+                severity: 'CRITICAL',
+                fix: 'Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId])',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            });
+            const usePrisma = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Prisma',
+                description: 'Use Prisma ORM',
+                severity: 'LOW',
+                fix: 'await prisma.user.findMany({ where: { id } })',
+                documentationLink: 'https://www.prisma.io/docs',
+            });
+            const useTypeORM = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use TypeORM',
+                description: 'Use TypeORM with QueryBuilder',
+                severity: 'LOW',
+                fix: 'userRepository.createQueryBuilder().where("id = :id", { id })',
+                documentationLink: 'https://typeorm.io/',
+            });
+            const useParameterized = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Parameterized',
+                description: 'Use parameterized query',
+                severity: 'LOW',
+                fix: 'db.query("SELECT * FROM users WHERE id = ?", [userId])',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            });
+            const useMongoSanitize = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use mongo-sanitize',
+                description: 'Use mongo-sanitize for MongoDB',
+                severity: 'LOW',
+                fix: 'sanitize(req.body)',
+                documentationLink: 'https://github.com/vkarpov15/mongo-sanitize',
+            });
+            const strategyParameterize = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Parameterize Strategy',
+                description: 'Use parameterized queries',
+                severity: 'LOW',
+                fix: 'Use ? or :name placeholders for user input',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            });
+            const strategyORM = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'ORM Strategy',
+                description: 'Migrate to ORM for automatic protection',
+                severity: 'LOW',
+                fix: 'Use Prisma, TypeORM, or Sequelize',
+                documentationLink: 'https://www.prisma.io/docs/concepts/overview/why-prisma',
+            });
+            const strategySanitize = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Sanitize Strategy',
+                description: 'Add input sanitization',
+                severity: 'LOW',
+                fix: 'Sanitize input as last resort',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            });
+            const strategyAuto = (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Auto Strategy',
+                description: 'Apply context-aware injection prevention',
+                severity: 'LOW',
+                fix: 'Use context-appropriate protection',
+                documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            });
+            return {
+                databaseInjection,
+                usePrisma,
+                useTypeORM,
+                useParameterized,
+                useMongoSanitize,
+                strategyParameterize,
+                strategyORM,
+                strategySanitize,
+                strategyAuto,
+            };
+        })(),
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    detectNoSQL: {
+                        type: 'boolean',
+                        default: true,
+                    },
+                    detectORMs: {
+                        type: 'boolean',
+                        default: true,
+                        description: 'Detect unsafe ORM usage',
+                    },
+                    trustedSources: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                    frameworkHints: {
+                        type: 'boolean',
+                        default: true,
+                        description: 'Provide framework-specific suggestions',
+                    },
+                    strategy: {
+                        type: 'string',
+                        enum: ['parameterize', 'orm', 'sanitize', 'auto'],
+                        default: 'auto',
+                        description: 'Strategy for fixing injection (auto = smart detection)'
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            detectNoSQL: true,
+            detectORMs: true,
+            trustedSources: [],
+            frameworkHints: true,
+            strategy: 'auto',
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { detectNoSQL = true, strategy = 'auto' } = options || {};
+        const sourceCode = context.sourceCode || context.sourceCode;
+        /**
+         * Select message ID based on strategy
+         * @todo Consider using this for suggestions in future versions
+         */
+        const selectStrategyMessage = () => {
+            switch (strategy) {
+                case 'parameterize':
+                    return 'strategyParameterize';
+                case 'orm':
+                    return 'strategyORM';
+                case 'sanitize':
+                    return 'strategySanitize';
+                case 'auto':
+                default:
+                    // Auto mode: prefer parameterized queries
+                    return 'useParameterized';
+            }
+        };
+        const filename = context.filename || context.getFilename();
+        /**
+         * SQL keywords for detection
+         */
+        const SQL_KEYWORDS = [
+            'SELECT', 'INSERT', 'UPDATE', 'DELETE', 'DROP', 'CREATE', 'ALTER',
+            'EXEC', 'EXECUTE', 'TRUNCATE', 'GRANT', 'REVOKE', 'WHERE', 'FROM', 'JOIN'
+        ];
+        /**
+         * NoSQL patterns
+         */
+        const NOSQL_PATTERNS = [
+            'find', 'findOne', 'findById', 'updateOne', 'updateMany', 'deleteOne',
+            'deleteMany', 'aggregate', '$where', '$regex'
+        ];
+        /**
+         * NoSQL query patterns in template literals (e.g., `this.name === "${userName}"`)
+         */
+        const NOSQL_QUERY_PATTERNS = [
+            /this\.\w+\s*===?\s*["']/i, // this.name === "value"
+            /this\.\w+\s*!==?\s*["']/i, // this.name !== "value"
+            /\$\w+\s*===?\s*["']/i, // $where === "value"
+        ];
+        /**
+         * Check if text contains SQL keywords
+         */
+        function containsSQLKeywords(text) {
+            const upperText = text.toUpperCase();
+            return SQL_KEYWORDS.some(keyword => upperText.includes(keyword));
+        }
+        /**
+         * Check if code is using NoSQL operations
+         */
+        function isNoSQLOperation(node) {
+            const text = sourceCode.getText(node);
+            return NOSQL_PATTERNS.some(pattern => text.includes(pattern));
+        }
+        /**
+         * Check if expression is tainted (contains user input)
+         */
+        function isTainted(node) {
+            const text = sourceCode.getText(node);
+            const { trustedSources = [] } = options;
+            // High confidence taint sources
+            const highConfidenceSources = [
+                'req.body', 'req.query', 'req.params', 'request.body',
+                'params.', 'query.', 'body.', 'input.', 'userInput'
+            ];
+            // Medium confidence taint sources
+            const mediumConfidenceSources = [
+                'props.', 'state.', 'context.', 'event.', 'data.'
+            ];
+            for (const source of highConfidenceSources) {
+                if (text.includes(source)) {
+                    return { tainted: true, source, confidence: 'high' };
+                }
+            }
+            for (const source of mediumConfidenceSources) {
+                if (text.includes(source)) {
+                    return { tainted: true, source, confidence: 'medium' };
+                }
+            }
+            // Check if this source is explicitly trusted (only for low-confidence sources)
+            for (const trusted of trustedSources) {
+                if (text.includes(trusted)) {
+                    return { tainted: false, confidence: 'low' };
+                }
+            }
+            // Check if it's a variable (low confidence)
+            if (node.type === 'Identifier' && !text.match(/^[A-Z_]+$/)) {
+                return { tainted: true, source: 'variable', confidence: 'low' };
+            }
+            return { tainted: false, confidence: 'low' };
+        }
+        /**
+         * Analyze vulnerability and provide detailed report
+         */
+        function analyzeVulnerability(node, vulnType) {
+            const taintInfo = isTainted(node);
+            return {
+                type: vulnType,
+                pattern: taintInfo.tainted
+                    ? `User input (${taintInfo.source}) in query`
+                    : 'Dynamic query construction',
+                severity: taintInfo.confidence === 'high' ? 'critical' : taintInfo.confidence === 'medium' ? 'high' : 'medium',
+                exploitability: taintInfo.confidence === 'high'
+                    ? 'Easily exploitable via API parameters'
+                    : 'Exploitable with access to input sources',
+                cwe: vulnType === 'SQL' ? 'CWE-89' : 'CWE-943',
+                owasp: 'A03:2021 - Injection',
+            };
+        }
+        /**
+         * Report additional strategy-specific suggestions
+         */
+        function reportStrategySuggestions(node) {
+            const strategyMessageId = selectStrategyMessage();
+            if (strategyMessageId !== 'useParameterized') { // Don't duplicate the main message
+                context.report({
+                    node,
+                    messageId: strategyMessageId,
+                });
+            }
+        }
+        /**
+         * Check template literal for SQL or NoSQL injection
+         */
+        function checkTemplateLiteral(node) {
+            const text = sourceCode.getText(node);
+            // Check for SQL injection
+            if (containsSQLKeywords(text) && node.expressions.length > 0) {
+                // Check if any expression is tainted
+                const taintedExprs = node.expressions.filter((expr) => isTainted(expr).tainted);
+                if (taintedExprs.length > 0) {
+                    const vulnDetails = analyzeVulnerability(node, 'SQL');
+                    const data = {
+                        type: vulnDetails.type,
+                        severity: vulnDetails.severity.toUpperCase(),
+                        filePath: filename,
+                        line: String(node.loc?.start.line ?? 0),
+                        cwe: vulnDetails.cwe,
+                        cweCode: vulnDetails.cwe.replace('CWE-', ''),
+                        currentExample: `db.query(\`SELECT * FROM users WHERE id = ${'${userId}'}\`)`,
+                        fixExample: `Use parameterized: db.query("SELECT * FROM users WHERE id = ?", [userId])`,
+                        docLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+                    };
+                    context.report({
+                        node,
+                        messageId: 'databaseInjection',
+                        data,
+                    });
+                    reportStrategySuggestions(node);
+                    return;
+                }
+            }
+            // Check for NoSQL injection patterns in template literals
+            if (detectNoSQL && node.expressions.length > 0) {
+                const hasNoSQLPattern = NOSQL_QUERY_PATTERNS.some(pattern => pattern.test(text));
+                if (hasNoSQLPattern) {
+                    // Check if any expression is tainted
+                    const taintedExprs = node.expressions.filter((expr) => isTainted(expr).tainted);
+                    if (taintedExprs.length > 0) {
+                        const vulnDetails = analyzeVulnerability(node, 'NoSQL');
+                        const data = {
+                            type: vulnDetails.type,
+                            severity: vulnDetails.severity.toUpperCase(),
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                            cwe: vulnDetails.cwe,
+                            cweCode: vulnDetails.cwe.replace('CWE-', ''),
+                            currentExample: `const query = \`this.name === "${'${userName}'}"\``,
+                            fixExample: `Sanitize input: const query = \`this.name === "\${mongoSanitize(userName)}"\``,
+                            docLink: 'https://owasp.org/www-community/attacks/NoSQL_Injection',
+                        };
+                        context.report({
+                            node,
+                            messageId: 'databaseInjection',
+                            data,
+                        });
+                        reportStrategySuggestions(node);
+                        return;
+                    }
+                }
+            }
+        }
+        /**
+         * Check NoSQL operations
+         */
+        function checkNoSQLOperation(node) {
+            if (!detectNoSQL)
+                return;
+            if (!isNoSQLOperation(node))
+                return;
+            // Check if arguments contain user input
+            const taintedArgs = node.arguments.filter((arg) => isTainted(arg).tainted);
+            if (taintedArgs.length === 0)
+                return;
+            const vulnDetails = analyzeVulnerability(node, 'NoSQL');
+            const data = {
+                type: vulnDetails.type,
+                severity: vulnDetails.severity.toUpperCase(),
+                filePath: filename,
+                line: String(node.loc?.start.line ?? 0),
+                cwe: vulnDetails.cwe,
+                cweCode: vulnDetails.cwe.replace('CWE-', ''),
+                currentExample: `User.findOne({ email: req.body.email })`,
+                fixExample: `Sanitize input: User.findOne({ email: mongoSanitize(req.body.email) })`,
+                docLink: 'https://owasp.org/www-community/attacks/NoSQL_Injection',
+            };
+            context.report({
+                node,
+                messageId: 'databaseInjection',
+                data,
+            });
+            reportStrategySuggestions(node);
+        }
+        /**
+         * Check binary expression (string concatenation) for SQL injection
+         */
+        function checkBinaryExpression(node) {
+            // Only check string concatenation with + operator
+            if (node.operator !== '+')
+                return;
+            // Get the full text of the binary expression
+            const text = sourceCode.getText(node);
+            // Check if it contains SQL keywords
+            if (!containsSQLKeywords(text))
+                return;
+            // Check if any part of the expression is tainted
+            const taintInfo = isTainted(node);
+            if (!taintInfo.tainted) {
+                // Also check left and right sides individually
+                const leftTainted = isTainted(node.left).tainted;
+                const rightTainted = isTainted(node.right).tainted;
+                if (!leftTainted && !rightTainted)
+                    return;
+            }
+            const vulnDetails = analyzeVulnerability(node, 'SQL');
+            const data = {
+                type: vulnDetails.type,
+                severity: vulnDetails.severity.toUpperCase(),
+                filePath: filename,
+                line: String(node.loc?.start.line ?? 0),
+                cwe: vulnDetails.cwe,
+                cweCode: vulnDetails.cwe.replace('CWE-', ''),
+                currentExample: `const query = "SELECT * FROM users WHERE name = '" + userName + "'"`,
+                fixExample: `Use parameterized: db.query("SELECT * FROM users WHERE name = ?", [userName])`,
+                docLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
+            };
+            context.report({
+                node,
+                messageId: 'databaseInjection',
+                data,
+            });
+            reportStrategySuggestions(node);
+        }
+        return {
+            TemplateLiteral: checkTemplateLiteral,
+            CallExpression: checkNoSQLOperation,
+            BinaryExpression: checkBinaryExpression,
+        };
+    },
+});
+//# sourceMappingURL=database-injection.js.map

package/src/rules/security/database-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-injection.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/database-injection.ts"],"names":[],"mappings":";;;AAQA,4DAA0E;AAC1E,4DAAsD;AAyCzC,QAAA,iBAAiB,GAAG,IAAA,0BAAU,EAA0B;IACnE,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,+EAA+E;SAC7F;QACD,QAAQ,EAAE,CAAC,GAAG,EAAE;YACd,MAAM,iBAAiB,GAAG,IAAA,gCAAgB,EAAC;gBACzC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,iFAAiF;gBACtF,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,gBAAgB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+CAA+C;gBACpD,iBAAiB,EAAE,4BAA4B;aAChD,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,+BAA+B;gBAC5C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+DAA+D;gBACpE,iBAAiB,EAAE,qBAAqB;aACzC,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,yBAAyB;gBACtC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oBAAoB;gBACzB,iBAAiB,EAAE,6CAA6C;aACjE,CAAC,CAAC;YACH,MAAM,oBAAoB,GAAG,IAAA,gCAAgB,EAAC;gBAC5C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,WAAW,EAAE,2BAA2B;gBACxC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,4CAA4C;gBACjD,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mCAAmC;gBACxC,iBAAiB,EAAE,yDAAyD;aAC7E,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+BAA+B;gBACpC,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,WAAW,EAAE,0CAA0C;gBACvD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oCAAoC;gBACzC,iBAAiB,EAAE,uDAAuD;aAC3E,CAAC,CAAC;YAEH,OAAO;gBACL,iBAAiB;gBACjB,SAAS;gBACT,UAAU;gBACV,gBAAgB;gBAChB,gBAAgB;gBAChB,oBAAoB;gBACpB,WAAW;gBACX,gBAAgB;gBAChB,YAAY;aACb,CAAC;QACJ,CAAC,CAAC,EAAE;QACJ,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE;wBACX,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;qBACd;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,yBAAyB;qBACvC;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;qBACZ;oBACD,cAAc,EAAE;wBACd,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,wCAAwC;qBACtD;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC;wBACjD,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,wDAAwD;qBACtE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,EAAE;YAClB,cAAc,EAAE,IAAI;YACpB,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,WAAW,GAAG,IAAI,EAClB,QAAQ,GAAG,MAAM,EAClB,GAAY,OAAO,IAAI,EAAE,CAAC;QAE3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAE5D;;;WAGG;QAEH,MAAM,qBAAqB,GAAG,GAAe,EAAE;YAC7C,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,cAAc;oBACjB,OAAO,sBAAsB,CAAC;gBAChC,KAAK,KAAK;oBACR,OAAO,aAAa,CAAC;gBACvB,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,MAAM,CAAC;gBACZ;oBACE,0CAA0C;oBAC1C,OAAO,kBAAkB,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3D;;WAEG;QACH,MAAM,YAAY,GAAG;YACnB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;YACjE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC1E,CAAC;QAEF;;WAEG;QACH,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;YACrE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;SAC9C,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG;YAC3B,0BAA0B,EAAG,wBAAwB;YACrD,0BAA0B,EAAI,wBAAwB;YACtD,sBAAsB,EAAQ,qBAAqB;SACpD,CAAC;QAEF;;WAEG;QACH,SAAS,mBAAmB,CAAC,IAAY;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAED;;WAEG;QACH,SAAS,gBAAgB,CAAC,IAAmB;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,CAAC;QAED;;WAEG;QACH,SAAS,SAAS,CAAC,IAAmB;YAKpC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,cAAc,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;YAExC,gCAAgC;YAChC,MAAM,qBAAqB,GAAG;gBAC5B,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc;gBACrD,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW;aACpD,CAAC;YAEF,kCAAkC;YAClC,MAAM,uBAAuB,GAAG;gBAC9B,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;aAClD,CAAC;YAEF,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;gBAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,+EAA+E;YAC/E,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;gBAC/C,CAAC;YACH,CAAC;YAED,4CAA4C;YAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAClE,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED;;WAEG;QACH,SAAS,oBAAoB,CAC3B,IAAmB,EACnB,QAAyB;YAEzB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAElC,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,SAAS,CAAC,OAAO;oBACxB,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,YAAY;oBAC7C,CAAC,CAAC,4BAA4B;gBAChC,QAAQ,EAAE,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9G,cAAc,EAAE,SAAS,CAAC,UAAU,KAAK,MAAM;oBAC7C,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,0CAA0C;gBAC9C,GAAG,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9C,KAAK,EAAE,sBAAsB;aAC9B,CAAC;QACJ,CAAC;QAED;;WAEG;QACH,SAAS,yBAAyB,CAAC,IAAmB;YACpD,MAAM,iBAAiB,GAAG,qBAAqB,EAAE,CAAC;YAClD,IAAI,iBAAiB,KAAK,kBAAkB,EAAE,CAAC,CAAC,mCAAmC;gBACjF,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED;;WAEG;QACH,SAAS,oBAAoB,CAAC,IAA8B;YAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEtC,0BAA0B;YAC1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/D,qCAAqC;gBACrC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAkD,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5H,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACtD,MAAM,IAAI,GAAG;wBACX,IAAI,EAAE,WAAW,CAAC,IAAI;wBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE;wBAC5C,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;wBACvC,GAAG,EAAE,WAAW,CAAC,GAAG;wBACpB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC5C,cAAc,EAAE,6CAA6C,WAAW,KAAK;wBAC7E,UAAU,EAAE,2EAA2E;wBACvF,OAAO,EAAE,uDAAuD;qBACjE,CAAC;oBACF,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,mBAAmB;wBAC9B,IAAI;qBACL,CAAC,CAAC;oBACH,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAC5B,OAAO;gBACT,CAAC;YACH,CAAC;YAED,0DAA0D;YAC1D,IAAI,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,IAAI,eAAe,EAAE,CAAC;oBACpB,qCAAqC;oBACrC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAkD,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;oBAC9H,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC5B,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBACxD,MAAM,IAAI,GAAG;4BACX,IAAI,EAAE,WAAW,CAAC,IAAI;4BACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE;4BAC5C,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;4BACvC,GAAG,EAAE,WAAW,CAAC,GAAG;4BACpB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;4BAC5C,cAAc,EAAE,kCAAkC,aAAa,KAAK;4BACpE,UAAU,EAAE,+EAA+E;4BAC3F,OAAO,EAAE,yDAAyD;yBACnE,CAAC;wBACF,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,mBAAmB;4BAC9B,IAAI;yBACL,CAAC,CAAC;wBACH,yBAAyB,CAAC,IAAI,CAAC,CAAC;wBAChC,OAAO;oBACT,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED;;WAEG;QACH,SAAS,mBAAmB,CAAC,IAA6B;YACxD,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEpC,wCAAwC;YACxC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAoC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5G,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAErC,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC5C,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBACvC,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5C,cAAc,EAAE,yCAAyC;gBACzD,UAAU,EAAE,wEAAwE;gBACpF,OAAO,EAAE,yDAAyD;aACnE,CAAC;YACF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,mBAAmB;gBAC9B,IAAI;aACL,CAAC,CAAC;YACH,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED;;WAEG;QACH,SAAS,qBAAqB,CAAC,IAA+B;YAC5D,kDAAkD;YAClD,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAAE,OAAO;YAElC,6CAA6C;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEtC,oCAAoC;YACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEvC,iDAAiD;YACjD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,+CAA+C;gBAC/C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBACjD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;gBACnD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;oBAAE,OAAO;YAC5C,CAAC;YAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC5C,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBACvC,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5C,cAAc,EAAE,qEAAqE;gBACrF,UAAU,EAAE,+EAA+E;gBAC3F,OAAO,EAAE,uDAAuD;aACjE,CAAC;YACF,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,mBAAmB;gBAC9B,IAAI;aACL,CAAC,CAAC;YACH,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,OAAO;YACL,eAAe,EAAE,oBAAoB;YACrC,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/detect-child-process.d.ts

@@ -0,0 +1,11 @@
+export interface Options {
+    /** Allow exec() with literal strings. Default: false (stricter) */
+    allowLiteralStrings?: boolean;
+    /** Allow spawn() with literal arguments. Default: false (stricter) */
+    allowLiteralSpawn?: boolean;
+    /** Additional child_process methods to check */
+    additionalMethods?: string[];
+    /** Strategy for fixing command injection: 'validate', 'sanitize', 'restrict', or 'auto' */
+    strategy?: 'validate' | 'sanitize' | 'restrict' | 'auto';
+}
+export declare const detectChildProcess: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;