eslint-plugin-secure-coding 1.0.0

package/src/rules/security/no-xxe-injection.js

@@ -0,0 +1,270 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noXxeInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+exports.noXxeInjection = (0, eslint_devkit_1.createRule)({
+    name: 'no-xxe-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detect XML External Entity (XXE) injection vulnerabilities',
+            url: 'https://cwe.mitre.org/data/definitions/611.html',
+        },
+        messages: {
+            xxeInjection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'XXE Injection',
+                cwe: 'CWE-611',
+                description: 'XML contains dangerous entity declarations',
+                severity: 'CRITICAL',
+                fix: 'Remove SYSTEM/PUBLIC entity declarations or use safe XML parser',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing',
+            }),
+            unsafeXmlParser: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe XML Parser',
+                cwe: 'CWE-611',
+                description: 'Using unsafe XML parser without secure configuration',
+                severity: 'HIGH',
+                fix: 'Use libxmljs with noent: false or xmldom with entityResolver: null',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html',
+            }),
+            externalEntityEnabled: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'External Entity Processing',
+                cwe: 'CWE-611',
+                description: 'External entity processing is enabled',
+                severity: 'CRITICAL',
+                fix: 'Disable external entity processing',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/611.html',
+            }),
+            untrustedXmlSource: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Untrusted XML Source',
+                cwe: 'CWE-611',
+                description: 'XML from untrusted source without validation',
+                severity: 'HIGH',
+                fix: 'Validate and sanitize XML input before parsing',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    safeParserOptions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                    },
+                    xmlValidationFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            safeParserOptions: ['noent', 'resolveExternals', 'expandEntityReferences', 'entityResolver'],
+            xmlValidationFunctions: ['validateXml', 'sanitizeXml', 'cleanXml', 'parseXmlSafe'],
+        },
+    ],
+    create(context, [options]) {
+        const { safeParserOptions = ['noent', 'resolveExternals', 'expandEntityReferences', 'entityResolver'], xmlValidationFunctions = ['validateXml', 'sanitizeXml', 'cleanXml', 'parseXmlSafe'], } = options || {};
+        const filename = context.filename || context.getFilename();
+        /**
+         * Check if this is an XML parsing operation
+         */
+        const isXmlParsingCall = (node) => {
+            const callee = node.callee;
+            // Check for XML library method calls
+            if (callee.type === 'MemberExpression' &&
+                callee.property.type === 'Identifier' &&
+                ['parse', 'parseFromString', 'parseString', 'parseXmlString', 'parseXML'].includes(callee.property.name)) {
+                return true;
+            }
+            // Check for constructor calls
+            if (callee.type === 'Identifier' &&
+                ['DOMParser', 'XMLHttpRequest', 'ActiveXObject'].includes(callee.name)) {
+                return true;
+            }
+            return false;
+        };
+        /**
+         * Check if parser options are secure
+         */
+        const hasSecureParserOptions = (optionsNode) => {
+            if (optionsNode.type !== 'ObjectExpression') {
+                return false;
+            }
+            // Check for secure options
+            for (const prop of optionsNode.properties) {
+                if (prop.type === 'Property' &&
+                    prop.key.type === 'Identifier' &&
+                    safeParserOptions.includes(prop.key.name)) {
+                    // Check if the value is secure
+                    if (prop.value.type === 'Literal' && prop.value.value === false) {
+                        return true;
+                    }
+                    if (prop.value.type === 'Literal' && prop.value.type === 'Literal' && prop.value.value === null) {
+                        return true;
+                    }
+                    if (prop.value.type === 'Identifier' && prop.value.name === 'null') {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        };
+        /**
+         * Check if parser options enable dangerous features
+         */
+        const hasDangerousParserOptions = (optionsNode) => {
+            if (optionsNode.type !== 'ObjectExpression') {
+                return false;
+            }
+            // Check for dangerous options
+            for (const prop of optionsNode.properties) {
+                if (prop.type === 'Property' &&
+                    prop.key.type === 'Identifier' &&
+                    ['resolveExternals', 'expandEntityReferences', 'noent'].includes(prop.key.name)) {
+                    // Check if the value enables dangerous features
+                    if (prop.value.type === 'Literal' && prop.value.value === true) {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        };
+        /**
+         * Check if input has been validated
+         */
+        const isXmlInputValidated = (xmlSource) => {
+            // Check if the input comes from a validation function
+            let current = xmlSource;
+            while (current) {
+                if (current.type === 'CallExpression' &&
+                    current.callee.type === 'Identifier' &&
+                    xmlValidationFunctions.includes(current.callee.name)) {
+                    return true;
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        /**
+         * Check if XML contains dangerous entity declarations
+         */
+        const containsDangerousEntities = (xmlText) => {
+            return /<!ENTITY/i.test(xmlText) &&
+                /SYSTEM\s+["']/i.test(xmlText);
+        };
+        /**
+         * Check if input source is untrusted
+         */
+        const isUntrustedXmlSource = (xmlSource) => {
+            // Check for user input sources
+            if (xmlSource.type === 'Identifier') {
+                const varName = xmlSource.name.toLowerCase();
+                // Consider variables with safe/validated names as trusted
+                if (['clean', 'safe', 'validated', 'sanitized', 'validatedxml', 'sanitizedxml'].some(safe => varName.includes(safe))) {
+                    return false;
+                }
+                return ['req', 'request', 'body', 'query', 'params', 'input', 'xml', 'data'].some(keyword => varName.includes(keyword));
+            }
+            // Check for file system reads (potentially untrusted)
+            let current = xmlSource;
+            while (current) {
+                if (current.type === 'CallExpression' &&
+                    current.callee.type === 'MemberExpression' &&
+                    current.callee.property.type === 'Identifier' &&
+                    ['readFileSync', 'readFile', 'createReadStream'].includes(current.callee.property.name)) {
+                    return true; // File input is potentially untrusted
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        return {
+            // Check XML parsing calls
+            CallExpression(node) {
+                if (!isXmlParsingCall(node)) {
+                    return;
+                }
+                const args = node.arguments;
+                if (args.length === 0) {
+                    return;
+                }
+                // Check XML input source
+                const xmlInput = args[0];
+                const isUntrusted = isUntrustedXmlSource(xmlInput);
+                const isValidated = isXmlInputValidated(xmlInput);
+                // Check if this parser call uses secure options
+                const hasSecureOptions = args.length >= 2 && hasSecureParserOptions(args[1]);
+                // CRITICAL: Untrusted XML input without validation (only if parser is not secure)
+                if (isUntrusted && !isValidated && !hasSecureOptions) {
+                    context.report({
+                        node: xmlInput,
+                        messageId: 'untrustedXmlSource',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                        },
+                    });
+                }
+                // Check for dangerous parser options
+                if (args.length >= 2) {
+                    const optionsArg = args[1];
+                    if (hasDangerousParserOptions(optionsArg)) {
+                        context.report({
+                            node: optionsArg,
+                            messageId: 'externalEntityEnabled',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                        return;
+                    }
+                    // DOMParser method safety is covered by constructor detection
+                    // No need to report unsafeXmlParser for individual method calls
+                }
+            },
+            // Check XML parser constructor calls
+            NewExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'Identifier' ||
+                    !['DOMParser', 'XMLHttpRequest', 'ActiveXObject'].includes(callee.name)) {
+                    return;
+                }
+                // Constructor calls for XML parsers are considered unsafe
+                context.report({
+                    node,
+                    messageId: 'unsafeXmlParser',
+                    data: {
+                        filePath: filename,
+                        line: String(node.loc?.start.line ?? 0),
+                    },
+                });
+            },
+            // Check for dangerous XML literals
+            Literal(node) {
+                if (typeof node.value === 'string' && containsDangerousEntities(node.value)) {
+                    context.report({
+                        node,
+                        messageId: 'xxeInjection',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                            safeAlternative: 'Use sanitized XML or remove entity declarations',
+                        },
+                    });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=no-xxe-injection.js.map

package/src/rules/security/no-xxe-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-xxe-injection.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/no-xxe-injection.ts"],"names":[],"mappings":";;;AAmBA,4DAAsD;AACtD,4DAA0E;AAkB7D,QAAA,cAAc,GAAG,IAAA,0BAAU,EAA0B;IAChE,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,4DAA4D;YACzE,GAAG,EAAE,iDAAiD;SACvD;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,iEAAiE;gBACtE,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mBAAmB;gBAC9B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,sDAAsD;gBACnE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oEAAoE;gBACzE,iBAAiB,EAAE,gGAAgG;aACpH,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,4BAA4B;gBACvC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,oCAAoC;gBACzC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,gGAAgG;aACpH,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;oBACD,sBAAsB,EAAE;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC1B;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,iBAAiB,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC;YAC5F,sBAAsB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC;SACnF;KACF;IACD,MAAM,CACJ,OAAsD,EACtD,CAAC,OAAO,CAAc;QAEtB,MAAM,EACJ,iBAAiB,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,EAC7F,sBAAsB,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,GACpF,GAAG,OAAO,IAAI,EAAE,CAAC;QAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3D;;WAEG;QACH,MAAM,gBAAgB,GAAG,CAAC,IAA6B,EAAW,EAAE;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAE3B,qCAAqC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBACrC,CAAC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7G,OAAO,IAAI,CAAC;YACd,CAAC;YAED,8BAA8B;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAC5B,CAAC,WAAW,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,sBAAsB,GAAG,CAAC,WAA0B,EAAW,EAAE;YACrE,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,2BAA2B;YAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBACxB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;oBAC9B,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAE9C,+BAA+B;oBAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBAChE,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;wBAChG,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBACnE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,yBAAyB,GAAG,CAAC,WAA0B,EAAW,EAAE;YACxE,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,8BAA8B;YAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBACxB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;oBAC9B,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAEpF,gDAAgD;oBAChD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,SAAwB,EAAW,EAAE;YAChE,sDAAsD;YACtD,IAAI,OAAO,GAA8B,SAAS,CAAC;YAEnD,OAAO,OAAO,EAAE,CAAC;gBACf,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;oBACjC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACpC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;YAC5C,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAW,EAAE;YAC7D,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,oBAAoB,GAAG,CAAC,SAAwB,EAAW,EAAE;YACjE,+BAA+B;YAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAE7C,0DAA0D;gBAC1D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvB,EAAE,CAAC;oBACF,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC1B,CAAC;YACJ,CAAC;YAED,sDAAsD;YACtD,IAAI,OAAO,GAA8B,SAAS,CAAC;YACnD,OAAO,OAAO,EAAE,CAAC;gBACf,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;oBACjC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC7C,CAAC,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC,CAAC,sCAAsC;gBACrD,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;YAC5C,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,OAAO;YACL,0BAA0B;YAC1B,cAAc,CAAC,IAA6B;gBAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;gBAED,yBAAyB;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBAElD,gDAAgD;gBAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE7E,kFAAkF;gBAClF,IAAI,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACrD,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,QAAQ;wBACd,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;yBACxC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,qCAAqC;gBACrC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACrB,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE3B,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC1C,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,UAAU;4BAChB,SAAS,EAAE,uBAAuB;4BAClC,IAAI,EAAE;gCACJ,QAAQ,EAAE,QAAQ;gCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;6BACxC;yBACF,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBAED,8DAA8D;oBAC9D,gEAAgE;gBAClE,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,aAAa,CAAC,IAA4B;gBACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5E,OAAO;gBACT,CAAC;gBAED,0DAA0D;gBAC1D,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;qBACxC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,mCAAmC;YACnC,OAAO,CAAC,IAAsB;gBAC5B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5E,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,cAAc;wBACzB,IAAI,EAAE;4BACJ,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;4BACvC,eAAe,EAAE,iDAAiD;yBACnE;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/no-zip-slip.d.ts

@@ -0,0 +1,9 @@
+export interface Options {
+    /** Archive extraction functions to check */
+    archiveFunctions?: string[];
+    /** Functions that safely validate archive paths */
+    pathValidationFunctions?: string[];
+    /** Safe archive extraction libraries */
+    safeLibraries?: string[];
+}
+export declare const noZipSlip: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;