eslint-plugin-secure-coding 1.0.0

package/src/rules/security/detect-eval-with-expression.js

@@ -0,0 +1,393 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectEvalWithExpression = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const EVAL_PATTERNS = [
+    {
+        pattern: 'JSON\\.parse|parse\\(.*\\)',
+        category: 'json',
+        safeAlternative: 'JSON.parse()',
+        example: {
+            bad: 'eval(\'{"key": "\' + value + \'"}"\')',
+            good: 'JSON.parse(\'{"key": "\' + value + \'"}"\')'
+        },
+        effort: '2 minutes'
+    },
+    {
+        pattern: 'Math\\.|parseInt|parseFloat',
+        category: 'math',
+        safeAlternative: 'Math functions or parseInt/parseFloat',
+        example: {
+            bad: 'eval(\'Math.\' + method + \'(\' + arg + \')\')',
+            good: 'const mathMethods = {sin: Math.sin, cos: Math.cos}; mathMethods[method](arg)'
+        },
+        effort: '5 minutes'
+    },
+    {
+        pattern: '\\$\\{|template|interpolat',
+        category: 'template',
+        safeAlternative: 'Template literals or template engine',
+        example: {
+            bad: 'eval(\'Hello \' + userName + \'!\')',
+            good: 'const template = `Hello ${userName}!`;'
+        },
+        effort: '3 minutes'
+    },
+    {
+        pattern: '\\[.*\\]|object\\[|obj\\.|\\.',
+        category: 'object',
+        safeAlternative: 'Direct property access or Map',
+        example: {
+            bad: 'eval(\'obj.\' + property)',
+            good: 'const allowedProps = {name: true, age: true}; if (allowedProps[property]) obj[property]'
+        },
+        effort: '8 minutes'
+    }
+];
+exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
+    name: 'detect-eval-with-expression',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects eval(variable) which can allow an attacker to run arbitrary code',
+        },
+        messages: {
+            // 🎯 Token optimization: 38% reduction (47→29 tokens) - compact format saves LLM processing
+            evalWithExpression: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'eval() with dynamic code',
+                cwe: 'CWE-95',
+                description: 'eval() with dynamic code',
+                severity: 'CRITICAL',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            useJsonParse: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe eval() for JSON parsing',
+                cwe: 'CWE-95',
+                description: 'Use JSON.parse() instead of eval() for JSON string parsing',
+                severity: 'HIGH',
+                fix: 'Replace eval() with JSON.parse()',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            useObjectAccess: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe eval() for property access',
+                cwe: 'CWE-95',
+                description: 'Use direct property access instead of eval() for dynamic property access',
+                severity: 'HIGH',
+                fix: 'Use obj[key] or Map.get(key) instead of eval()',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            useTemplateLiteral: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe eval() for string interpolation',
+                cwe: 'CWE-95',
+                description: 'Use template literals instead of eval() for string interpolation',
+                severity: 'HIGH',
+                fix: 'Replace eval() with template literals: `Hello ${name}`',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            useFunctionConstructor: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe eval() for function creation',
+                cwe: 'CWE-95',
+                description: 'Use Function constructor with validation instead of eval()',
+                severity: 'HIGH',
+                fix: 'Replace eval() with validated Function constructor',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            useSaferAlternative: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe eval() usage detected',
+                cwe: 'CWE-95',
+                description: 'eval() with dynamic code execution detected',
+                severity: 'HIGH',
+                fix: '{{alternative}}',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            strategyRemove: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Critical eval() security vulnerability',
+                cwe: 'CWE-95',
+                description: 'eval() usage poses severe security risk',
+                severity: 'CRITICAL',
+                fix: 'Remove eval() entirely - security risk too high',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            strategyRefactor: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'eval() refactoring required',
+                cwe: 'CWE-95',
+                description: 'eval() can be refactored to safer alternative',
+                severity: 'HIGH',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            }),
+            strategyValidate: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'eval() input validation needed',
+                cwe: 'CWE-95',
+                description: 'eval() requires input validation for security',
+                severity: 'MEDIUM',
+                fix: 'Add input validation before using eval()',
+                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowLiteralStrings: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow eval with literal strings (false = stricter)'
+                    },
+                    additionalEvalFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional functions to treat as eval-like'
+                    },
+                    strategy: {
+                        type: 'string',
+                        enum: ['remove', 'refactor', 'validate', 'auto'],
+                        default: 'auto',
+                        description: 'Strategy for fixing eval usage (auto = smart detection)'
+                    }
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowLiteralStrings: false,
+            additionalEvalFunctions: [],
+            strategy: 'auto'
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { allowLiteralStrings = false, additionalEvalFunctions = [], strategy = 'auto' } = options || {};
+        /**
+         * All functions that can execute arbitrary code
+         * NOTE: setTimeout/setInterval are NOT eval-like - they don't execute code strings
+         */
+        const evalFunctions = [
+            'eval',
+            'Function',
+            ...additionalEvalFunctions
+        ];
+        /**
+         * Check if a node is a literal string (safe)
+         */
+        const isLiteralString = (node) => {
+            return node.type === 'Literal' && typeof node.value === 'string';
+        };
+        /**
+         * Select message ID based on strategy
+         */
+        const selectStrategyMessage = (pattern) => {
+            switch (strategy) {
+                case 'remove':
+                    return 'strategyRemove';
+                case 'refactor':
+                    return 'strategyRefactor';
+                case 'validate':
+                    return 'strategyValidate';
+                case 'auto':
+                default:
+                    // Auto mode: choose based on pattern confidence
+                    if (pattern && pattern.category === 'json') {
+                        return 'useJsonParse';
+                    }
+                    if (pattern && pattern.category === 'object') {
+                        return 'useObjectAccess';
+                    }
+                    if (pattern && pattern.category === 'template') {
+                        return 'useTemplateLiteral';
+                    }
+                    return 'strategyRefactor'; // Default to refactor for unknown patterns
+            }
+        };
+        /**
+         * Detect the pattern category from the expression
+         */
+        const detectPattern = (expression) => {
+            for (const pattern of EVAL_PATTERNS) {
+                if (new RegExp(pattern.pattern, 'i').test(expression)) {
+                    return pattern;
+                }
+            }
+            return null;
+        };
+        /**
+         * Generate refactoring steps based on pattern
+         */
+        const generateRefactoringSteps = (pattern) => {
+            if (!pattern) {
+                return [
+                    '   1. Remove eval() usage entirely',
+                    '   2. Identify what the code is trying to achieve',
+                    '   3. Use appropriate safe alternative (JSON.parse, Map, etc.)',
+                    '   4. Add input validation if dynamic behavior needed',
+                    '   5. Test thoroughly for edge cases'
+                ].join('\n');
+            }
+            switch (pattern.category) {
+                case 'json':
+                    return [
+                        '   1. Replace eval() with JSON.parse()',
+                        '   2. Ensure input is valid JSON string',
+                        '   3. Add try/catch for JSON parsing errors',
+                        '   4. Consider using a JSON schema validator'
+                    ].join('\n');
+                case 'math':
+                    return [
+                        '   1. Create whitelist of allowed Math functions',
+                        '   2. Use direct function calls: Math.sin(x)',
+                        '   3. Validate inputs are numbers',
+                        '   4. Consider using a math expression parser library'
+                    ].join('\n');
+                case 'template':
+                    return [
+                        '   1. Use template literals: `Hello ${name}`',
+                        '   2. Sanitize variables before interpolation',
+                        '   3. Use a template engine like Handlebars if complex',
+                        '   4. Validate template structure'
+                    ].join('\n');
+                case 'object':
+                    return [
+                        '   1. Use Map or plain object for key-value access',
+                        '   2. Whitelist allowed property names',
+                        '   3. Use hasOwnProperty() check',
+                        '   4. Consider Object.create(null) for clean objects'
+                    ].join('\n');
+                default:
+                    return [
+                        '   1. Identify the specific use case',
+                        '   2. Find a safer alternative approach',
+                        '   3. Add comprehensive input validation',
+                        '   4. Use static analysis if possible'
+                    ].join('\n');
+            }
+        };
+        /**
+         * Extract expression text for pattern analysis
+         */
+        const extractExpression = (node) => {
+            const sourceCode = context.sourceCode || context.sourceCode;
+            // Try to get the argument text
+            if (node.arguments.length > 0) {
+                return sourceCode.getText(node.arguments[0]);
+            }
+            return 'dynamic expression';
+        };
+        /**
+         * Check call expressions for dangerous eval usage
+         */
+        const checkCallExpression = (node) => {
+            // Check if it's a call to an eval-like function
+            if (node.callee.type === 'Identifier' &&
+                evalFunctions.includes(node.callee.name)) {
+                // Skip if it's a literal string and literals are allowed
+                if (allowLiteralStrings &&
+                    node.arguments.length > 0 &&
+                    isLiteralString(node.arguments[0])) {
+                    return;
+                }
+                // Skip if it's a direct string literal (safe)
+                if (node.arguments.length > 0 &&
+                    node.callee.name === 'eval' &&
+                    isLiteralString(node.arguments[0])) {
+                    return;
+                }
+                const expression = extractExpression(node);
+                const pattern = detectPattern(expression);
+                const steps = generateRefactoringSteps(pattern);
+                const strategyMessageId = selectStrategyMessage(pattern);
+                context.report({
+                    node,
+                    messageId: strategyMessageId,
+                    data: {
+                        expression,
+                        patternCategory: pattern?.category || 'dynamic code execution',
+                        safeAlternative: pattern?.safeAlternative || 'Remove eval entirely',
+                        steps,
+                        effort: pattern?.effort || '15-30 minutes'
+                    },
+                    suggest: pattern ? [
+                        {
+                            messageId: strategyMessageId,
+                            data: {
+                                safeAlternative: pattern.safeAlternative,
+                                alternative: pattern.safeAlternative
+                            },
+                            fix: () => null // Complex refactoring, cannot auto-fix safely
+                        }
+                    ] : undefined
+                });
+            }
+            // Also check for Function constructor usage
+            if (node.callee.type === 'NewExpression' &&
+                node.callee.callee.type === 'Identifier' &&
+                node.callee.callee.name === 'Function') {
+                const expression = extractExpression(node);
+                const pattern = detectPattern(expression);
+                const strategyMessageId = selectStrategyMessage(pattern);
+                context.report({
+                    node,
+                    messageId: strategyMessageId,
+                    data: {
+                        expression: `new Function(${expression})`,
+                        patternCategory: 'function constructor',
+                        safeAlternative: 'Arrow function or regular function',
+                        steps: [
+                            '   1. Replace Function constructor with arrow function',
+                            '   2. Use regular function declaration',
+                            '   3. Validate any dynamic parts',
+                            '   4. Consider module imports instead'
+                        ].join('\n'),
+                        effort: '10 minutes'
+                    }
+                });
+            }
+        };
+        /**
+         * Check NewExpression for Function constructor usage
+         */
+        const checkNewExpression = (node) => {
+            // Check for new Function() usage
+            if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
+                const sourceCode = context.sourceCode || context.sourceCode;
+                const expression = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
+                const pattern = detectPattern(expression);
+                const strategyMessageId = selectStrategyMessage(pattern);
+                context.report({
+                    node,
+                    messageId: strategyMessageId,
+                    data: {
+                        expression: `new Function(${expression})`,
+                        patternCategory: 'function constructor',
+                        safeAlternative: 'Arrow function or regular function',
+                        steps: [
+                            '   1. Replace Function constructor with arrow function',
+                            '   2. Use regular function declaration',
+                            '   3. Validate any dynamic parts',
+                            '   4. Consider module imports instead'
+                        ].join('\n'),
+                        effort: '10 minutes'
+                    }
+                });
+            }
+        };
+        return {
+            CallExpression: checkCallExpression,
+            NewExpression: checkNewExpression
+        };
+    },
+});
+//# sourceMappingURL=detect-eval-with-expression.js.map

package/src/rules/security/detect-eval-with-expression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-eval-with-expression.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/detect-eval-with-expression.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAqCtD,MAAM,aAAa,GAAkB;IACnC;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,cAAc;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,uCAAuC;YAC5C,IAAI,EAAE,6CAA6C;SACpD;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,uCAAuC;QACxD,OAAO,EAAE;YACP,GAAG,EAAE,gDAAgD;YACrD,IAAI,EAAE,8EAA8E;SACrF;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,UAAU;QACpB,eAAe,EAAE,sCAAsC;QACvD,OAAO,EAAE;YACP,GAAG,EAAE,qCAAqC;YAC1C,IAAI,EAAE,wCAAwC;SAC/C;QACD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,+BAA+B;QAChD,OAAO,EAAE;YACP,GAAG,EAAE,2BAA2B;YAChC,IAAI,EAAE,yFAAyF;SAChG;QACD,MAAM,EAAE,WAAW;KACpB;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAG,IAAA,0BAAU,EAA0B;IAC1E,IAAI,EAAE,6BAA6B;IACnC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,0EAA0E;SACxF;QACD,QAAQ,EAAE;YACR,4FAA4F;YAC5F,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0BAA0B;gBACvC,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,YAAY,EAAE,IAAA,gCAAgB,EAAC;gBAC7B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,mCAAmC;gBAC9C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,0EAA0E;gBACvF,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,gDAAgD;gBACrD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,kEAAkE;gBAC/E,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,wDAAwD;gBAC7D,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qCAAqC;gBAChD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,4DAA4D;gBACzE,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,iBAAiB;gBACtB,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,wCAAwC;gBACnD,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,UAAU;gBACpB,GAAG,EAAE,iDAAiD;gBACtD,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,6BAA6B;gBACxC,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;YACF,gBAAgB,EAAE,IAAA,gCAAgB,EAAC;gBACjC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,gCAAgC;gBAC3C,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,+CAA+C;gBAC5D,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,wDAAwD;aAC5E,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;oBACD,uBAAuB,EAAE;wBACvB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,4CAA4C;qBAC1D;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;wBAChD,OAAO,EAAE,MAAM;wBACf,WAAW,EAAE,yDAAyD;qBACvE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,mBAAmB,EAAE,KAAK;YAC1B,uBAAuB,EAAE,EAAE;YAC3B,QAAQ,EAAE,MAAM;SACjB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,mBAAmB,GAAG,KAAK,EAC3B,uBAAuB,GAAG,EAAE,EAC5B,QAAQ,GAAG,MAAM,EAClB,GAAY,OAAO,IAAI,EAAE,CAAC;QAE3B;;;WAGG;QACH,MAAM,aAAa,GAAG;YACpB,MAAM;YACN,UAAU;YACV,GAAG,uBAAuB;SAC3B,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,qBAAqB,GAAG,CAAC,OAA2B,EAAc,EAAE;YACxE,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,QAAQ;oBACX,OAAO,gBAAgB,CAAC;gBAC1B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,UAAU;oBACb,OAAO,kBAAkB,CAAC;gBAC5B,KAAK,MAAM,CAAC;gBACZ;oBACE,gDAAgD;oBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;wBAC3C,OAAO,cAAc,CAAC;oBACxB,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC7C,OAAO,iBAAiB,CAAC;oBAC3B,CAAC;oBACD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;wBAC/C,OAAO,oBAAoB,CAAC;oBAC9B,CAAC;oBACD,OAAO,kBAAkB,CAAC,CAAC,2CAA2C;YAC1E,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAsB,EAAE;YAC/D,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtD,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,wBAAwB,GAAG,CAAC,OAA2B,EAAU,EAAE;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,oCAAoC;oBACpC,mDAAmD;oBACnD,gEAAgE;oBAChE,uDAAuD;oBACvD,sCAAsC;iBACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;YAED,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM;oBACT,OAAO;wBACL,wCAAwC;wBACxC,yCAAyC;wBACzC,6CAA6C;wBAC7C,8CAA8C;qBAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,MAAM;oBACT,OAAO;wBACL,kDAAkD;wBAClD,8CAA8C;wBAC9C,mCAAmC;wBACnC,uDAAuD;qBACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,UAAU;oBACb,OAAO;wBACL,8CAA8C;wBAC9C,+CAA+C;wBAC/C,wDAAwD;wBACxD,mCAAmC;qBACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,QAAQ;oBACX,OAAO;wBACL,oDAAoD;wBACpD,wCAAwC;wBACxC,kCAAkC;wBAClC,sDAAsD;qBACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf;oBACE,OAAO;wBACL,sCAAsC;wBACtC,yCAAyC;wBACzC,0CAA0C;wBAC1C,uCAAuC;qBACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,iBAAiB,GAAG,CAAC,IAA6B,EAAU,EAAE;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;YAE5D,+BAA+B;YAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,OAAO,oBAAoB,CAAC;QAC9B,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC5D,gDAAgD;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACjC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAE7C,yDAAyD;gBACzD,IAAI,mBAAmB;oBACnB,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;oBAC3B,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO;gBACT,CAAC;gBAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU;wBACV,eAAe,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB;wBAC9D,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,sBAAsB;wBACnE,KAAK;wBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,eAAe;qBAC3C;oBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjB;4BACE,SAAS,EAAE,iBAAiB;4BAC5B,IAAI,EAAE;gCACJ,eAAe,EAAE,OAAO,CAAC,eAAe;gCACxC,WAAW,EAAE,OAAO,CAAC,eAAe;6BACrC;4BACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,8CAA8C;yBAC/D;qBACF,CAAC,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAE3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAA4B,EAAE,EAAE;YAC1D,iCAAiC;YACjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;gBAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClG,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,iBAAiB;oBAC5B,IAAI,EAAE;wBACJ,UAAU,EAAE,gBAAgB,UAAU,GAAG;wBACzC,eAAe,EAAE,sBAAsB;wBACvC,eAAe,EAAE,oCAAoC;wBACrD,KAAK,EAAE;4BACL,wDAAwD;4BACxD,wCAAwC;4BACxC,kCAAkC;4BAClC,uCAAuC;yBACxC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACZ,MAAM,EAAE,YAAY;qBACrB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,mBAAmB;YACnC,aAAa,EAAE,kBAAkB;SAClC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/detect-non-literal-fs-filename.d.ts

@@ -0,0 +1,7 @@
+export interface Options {
+    /** Allow literal strings. Default: false (stricter) */
+    allowLiterals?: boolean;
+    /** Additional fs methods to check */
+    additionalMethods?: string[];
+}
+export declare const detectNonLiteralFsFilename: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;