eslint-plugin-secure-coding 1.0.0

package/src/rules/security/detect-non-literal-regexp.js

@@ -0,0 +1,387 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectNonLiteralRegexp = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+// Type guard for regex literal nodes
+const isRegExpLiteral = (node) => {
+    return node.type === 'Literal' && Object.prototype.hasOwnProperty.call(node, 'regex');
+};
+const REGEXP_PATTERNS = [
+    {
+        pattern: 'new RegExp\\(.*\\)',
+        dangerous: true,
+        vulnerability: 'redos',
+        safeAlternative: 'Pre-defined RegExp constants',
+        example: {
+            bad: 'new RegExp(userInput)',
+            good: 'const PATTERNS = { email: /^[a-zA-Z0-9]+$/ }; PATTERNS[userChoice]'
+        },
+        effort: '10-15 minutes',
+        riskLevel: 'high'
+    },
+    {
+        pattern: 'RegExp\\(.*\\)',
+        dangerous: true,
+        vulnerability: 'redos',
+        safeAlternative: 'Static RegExp literals or validated patterns',
+        example: {
+            bad: 'RegExp(userPattern)',
+            good: 'const safePattern = userPattern.replace(/[.*+?^${}()|[\\]\\\\]/g, \'\\\\$&\'); new RegExp(`^${safePattern}$`)'
+        },
+        effort: '15-20 minutes',
+        riskLevel: 'high'
+    },
+    {
+        pattern: '/.*\\*\\*.*|.*\\+\\+.*|.*\\?\\?/',
+        dangerous: true,
+        vulnerability: 'redos',
+        safeAlternative: 'Avoid nested quantifiers, use atomic groups',
+        example: {
+            bad: '/(a+)+b/', // ReDoS vulnerable
+            good: '/(?>a+)b/', // Atomic group (if supported) or restructure
+        },
+        effort: '20-30 minutes',
+        riskLevel: 'critical'
+    }
+];
+exports.detectNonLiteralRegexp = (0, eslint_devkit_2.createRule)({
+    name: 'detect-non-literal-regexp',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression',
+        },
+        messages: {
+            // 🎯 Token optimization: 41% reduction (51→30 tokens) - compact template variables
+            regexpReDoS: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.WARNING,
+                issueName: 'ReDoS vulnerability',
+                cwe: 'CWE-400',
+                description: 'ReDoS vulnerability detected',
+                severity: '{{riskLevel}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
+            }),
+            useStaticRegex: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Static Regex',
+                description: 'Use pre-defined RegExp constants',
+                severity: 'LOW',
+                fix: 'const PATTERN = /^[a-z]+$/; // Define at module level',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp',
+            }),
+            validateInput: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Validate Input',
+                description: 'Validate and escape user input',
+                severity: 'LOW',
+                fix: 'Validate input length and characters before RegExp',
+                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
+            }),
+            useRegexLibrary: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Safe Library',
+                description: 'Use safe-regex library or re2',
+                severity: 'LOW',
+                fix: 'import { isSafe } from "safe-regex"; if (isSafe(pattern)) ...',
+                documentationLink: 'https://github.com/substack/safe-regex',
+            }),
+            addTimeout: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Add Timeout',
+                description: 'Add timeout to regex operations',
+                severity: 'LOW',
+                fix: 'Use timeout wrapper for regex operations',
+                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
+            }),
+            escapeUserInput: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Escape Input',
+                description: 'Escape special regex characters',
+                severity: 'LOW',
+                fix: 'input.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowLiterals: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow literal string regex patterns'
+                    },
+                    additionalPatterns: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional RegExp creation patterns to check'
+                    },
+                    maxPatternLength: {
+                        type: 'number',
+                        default: 100,
+                        minimum: 1,
+                        description: 'Maximum allowed pattern length for dynamic regex'
+                    }
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            allowLiterals: false,
+            additionalPatterns: [],
+            maxPatternLength: 100
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { allowLiterals = false, maxPatternLength = 100 } = options || {};
+        /**
+         * Check if a node is a literal string (potentially safe)
+         */
+        const isLiteralString = (node) => {
+            return node.type === 'Literal' && typeof node.value === 'string';
+        };
+        /**
+         * Check if a regex pattern contains dangerous ReDoS patterns
+         */
+        const hasReDoSPatterns = (pattern) => {
+            // Common ReDoS patterns
+            return /(?:\*\*|\+\+|\\?\\?|\\*\\*)/.test(pattern) || // Nested quantifiers
+                /(a+)+b|(x+)+y|(a*)*b/.test(pattern) || // Exponential backtracking
+                /([a-zA-Z]+)*[a-zA-Z]/.test(pattern); // Polynomial backtracking
+        };
+        /**
+         * Extract regex pattern from RegExp construction
+         */
+        const extractPattern = (node) => {
+            const sourceCode = context.sourceCode || context.sourceCode;
+            // Determine constructor type
+            let constructor = 'RegExp';
+            if (node.type === 'NewExpression' && node.callee.type === 'Identifier') {
+                constructor = `new ${node.callee.name}`;
+            }
+            // First argument is the pattern
+            const patternNode = node.arguments.length > 0 ? node.arguments[0] : null;
+            const pattern = patternNode ? sourceCode.getText(patternNode) : '';
+            const isDynamic = patternNode ? !isLiteralString(patternNode) : false;
+            const length = patternNode && isLiteralString(patternNode) ?
+                String(patternNode.value).length : pattern.length;
+            return { pattern, patternNode, constructor, isDynamic, length };
+        };
+        /**
+         * Detect the specific vulnerability pattern
+         */
+        const detectVulnerability = (pattern, isDynamic) => {
+            // Check for dynamic construction first (highest risk)
+            if (isDynamic) {
+                for (const vuln of REGEXP_PATTERNS) {
+                    if (new RegExp(vuln.pattern, 'i').test(pattern)) {
+                        return vuln;
+                    }
+                }
+                // Generic dynamic RegExp construction
+                return {
+                    pattern: 'dynamic',
+                    dangerous: true,
+                    vulnerability: 'redos',
+                    safeAlternative: 'Pre-defined RegExp constants',
+                    example: {
+                        bad: pattern,
+                        good: 'const PATTERNS = { email: /^[a-zA-Z0-9]+$/ }; PATTERNS[type]'
+                    },
+                    effort: '10-15 minutes',
+                    riskLevel: 'high'
+                };
+            }
+            // Check for ReDoS patterns in literal regex
+            if (hasReDoSPatterns(pattern)) {
+                return {
+                    pattern: 'redos-literal',
+                    dangerous: true,
+                    vulnerability: 'redos',
+                    safeAlternative: 'Restructure regex to avoid nested quantifiers',
+                    example: {
+                        bad: pattern,
+                        good: pattern.replace(/(a+)\+/g, '$1') // Simplified example
+                    },
+                    effort: '20-30 minutes',
+                    riskLevel: 'high'
+                };
+            }
+            return null;
+        };
+        /**
+         * Generate refactoring steps based on the vulnerability
+         */
+        const generateRefactoringSteps = (vulnerability) => {
+            if (vulnerability.pattern === 'dynamic') {
+                return [
+                    '   1. Create a whitelist of allowed regex patterns',
+                    '   2. Use object lookup: PATTERNS[userChoice]',
+                    '   3. If dynamic needed: escape input with regex escaping function',
+                    '   4. Add pattern length validation',
+                    '   5. Consider using a safe regex library'
+                ].join('\n');
+            }
+            if (vulnerability.pattern === 'redos-literal') {
+                return [
+                    '   1. Identify nested quantifiers (*+, ++, ?+)',
+                    '   2. Restructure regex to avoid exponential backtracking',
+                    '   3. Use atomic groups if supported: (?>...)',
+                    '   4. Test regex performance with long inputs',
+                    '   5. Consider alternatives like string methods'
+                ].join('\n');
+            }
+            switch (vulnerability.vulnerability) {
+                case 'redos':
+                    return [
+                        '   1. Avoid nested quantifiers and backreferences',
+                        '   2. Use possessive quantifiers: *+, ++, ?+',
+                        '   3. Restructure regex to be more specific',
+                        '   4. Test with potentially malicious inputs',
+                        '   5. Consider safe-regex library validation'
+                    ].join('\n');
+                case 'injection':
+                    return [
+                        '   1. Escape user input before RegExp construction',
+                        '   2. Use RegExp.escape() if available',
+                        '   3. Validate input against allowed character sets',
+                        '   4. Add length limits to prevent oversized patterns',
+                        '   5. Use static patterns when possible'
+                    ].join('\n');
+                default:
+                    return [
+                        '   1. Identify the specific regex use case',
+                        '   2. Choose appropriate safe alternative',
+                        '   3. Add input validation and escaping',
+                        '   4. Test thoroughly with edge cases',
+                        '   5. Monitor performance in production'
+                    ].join('\n');
+            }
+        };
+        /**
+         * Determine overall risk level
+         */
+        const determineRiskLevel = (vulnerability, pattern) => {
+            if (vulnerability.riskLevel === 'critical' || hasReDoSPatterns(pattern)) {
+                return 'CRITICAL';
+            }
+            if (vulnerability.riskLevel === 'high') {
+                return 'HIGH';
+            }
+            return 'MEDIUM';
+        };
+        /**
+         * Check RegExp constructor calls for vulnerabilities
+         */
+        const checkRegExpCall = (node) => {
+            // Check for RegExp constructor calls
+            const isRegExpCall = node.callee.type === 'Identifier' && node.callee.name === 'RegExp';
+            const isNewRegExp = node.type === 'NewExpression' && node.callee.type === 'Identifier' && node.callee.name === 'RegExp';
+            if (!isRegExpCall && !isNewRegExp) {
+                return;
+            }
+            const { pattern, patternNode, isDynamic, length } = extractPattern(node);
+            // Allow literals if configured and pattern is reasonable length
+            if (allowLiterals && patternNode && isLiteralString(patternNode) && length <= maxPatternLength) {
+                // Still check for ReDoS patterns even in literals
+                if (!hasReDoSPatterns(pattern)) {
+                    return;
+                }
+            }
+            const vulnerability = detectVulnerability(pattern, isDynamic);
+            // If no specific vulnerability detected but it's dynamic, still warn
+            const effectiveVulnerability = vulnerability || (isDynamic ? {
+                pattern: 'dynamic',
+                dangerous: true,
+                vulnerability: 'redos',
+                safeAlternative: 'Use static RegExp patterns',
+                example: {
+                    bad: pattern,
+                    good: '/^safe-pattern$/'
+                },
+                effort: '10-15 minutes',
+                riskLevel: 'medium'
+            } : null);
+            if (!effectiveVulnerability) {
+                return;
+            }
+            const riskLevel = determineRiskLevel(effectiveVulnerability, pattern);
+            const steps = generateRefactoringSteps(effectiveVulnerability);
+            context.report({
+                node,
+                messageId: 'regexpReDoS',
+                data: {
+                    pattern: pattern.substring(0, 30) + (pattern.length > 30 ? '...' : ''),
+                    riskLevel,
+                    vulnerability: effectiveVulnerability.vulnerability,
+                    safeAlternative: effectiveVulnerability.safeAlternative,
+                    steps,
+                    effort: effectiveVulnerability.effort
+                },
+                suggest: [
+                    {
+                        messageId: 'useStaticRegex',
+                        fix: () => null
+                    },
+                    {
+                        messageId: 'validateInput',
+                        fix: () => null
+                    },
+                    {
+                        messageId: 'useRegexLibrary',
+                        fix: () => null
+                    },
+                    {
+                        messageId: 'addTimeout',
+                        fix: () => null
+                    },
+                    {
+                        messageId: 'escapeUserInput',
+                        fix: () => null
+                    }
+                ]
+            });
+        };
+        /**
+         * Check literal regex patterns for ReDoS vulnerabilities
+         */
+        const checkLiteralRegExp = (node) => {
+            if (!isRegExpLiteral(node)) {
+                return;
+            }
+            const pattern = node.regex.pattern;
+            // Check for ReDoS patterns
+            if (hasReDoSPatterns(pattern)) {
+                const vulnerability = detectVulnerability(pattern, false);
+                if (vulnerability) {
+                    const riskLevel = determineRiskLevel(vulnerability, pattern);
+                    const steps = generateRefactoringSteps(vulnerability);
+                    context.report({
+                        node,
+                        messageId: 'regexpReDoS',
+                        data: {
+                            pattern: pattern.substring(0, 30) + (pattern.length > 30 ? '...' : ''),
+                            riskLevel,
+                            vulnerability: vulnerability.vulnerability,
+                            safeAlternative: vulnerability.safeAlternative,
+                            steps,
+                            effort: vulnerability.effort
+                        }
+                    });
+                }
+            }
+        };
+        return {
+            CallExpression: checkRegExpCall,
+            NewExpression: checkRegExpCall,
+            Literal: checkLiteralRegExp
+        };
+    },
+});
+//# sourceMappingURL=detect-non-literal-regexp.js.map

package/src/rules/security/detect-non-literal-regexp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-non-literal-regexp.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-secure-coding/src/rules/security/detect-non-literal-regexp.ts"],"names":[],"mappings":";;;AASA,4DAA0E;AAC1E,4DAAsD;AAuBtD,qCAAqC;AACrC,MAAM,eAAe,GAAG,CAAC,IAAmB,EAA4E,EAAE;IACxH,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxF,CAAC,CAAC;AAeF,MAAM,eAAe,GAAoB;IACvC;QACE,OAAO,EAAE,oBAAoB;QAC7B,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,OAAO;QACtB,eAAe,EAAE,8BAA8B;QAC/C,OAAO,EAAE;YACP,GAAG,EAAE,uBAAuB;YAC5B,IAAI,EAAE,oEAAoE;SAC3E;QACD,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,MAAM;KAClB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,OAAO;QACtB,eAAe,EAAE,8CAA8C;QAC/D,OAAO,EAAE;YACP,GAAG,EAAE,qBAAqB;YAC1B,IAAI,EAAE,+GAA+G;SACtH;QACD,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,MAAM;KAClB;IACD;QACE,OAAO,EAAE,kCAAkC;QAC3C,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,OAAO;QACtB,eAAe,EAAE,6CAA6C;QAC9D,OAAO,EAAE;YACP,GAAG,EAAE,UAAU,EAAE,mBAAmB;YACpC,IAAI,EAAE,WAAW,EAAE,6CAA6C;SACjE;QACD,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,UAAU;KACtB;CACF,CAAC;AAEW,QAAA,sBAAsB,GAAG,IAAA,0BAAU,EAA0B;IACxE,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,mHAAmH;SACjI;QACD,QAAQ,EAAE;YACR,mFAAmF;YACnF,WAAW,EAAE,IAAA,gCAAgB,EAAC;gBAC5B,IAAI,EAAE,4BAAY,CAAC,OAAO;gBAC1B,SAAS,EAAE,qBAAqB;gBAChC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,8BAA8B;gBAC3C,QAAQ,EAAE,eAAe;gBACzB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,kCAAkC;gBAC/C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,uDAAuD;gBAC5D,iBAAiB,EAAE,yFAAyF;aAC7G,CAAC;YACF,aAAa,EAAE,IAAA,gCAAgB,EAAC;gBAC9B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,gCAAgC;gBAC7C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,oDAAoD;gBACzD,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,WAAW,EAAE,+BAA+B;gBAC5C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+DAA+D;gBACpE,iBAAiB,EAAE,wCAAwC;aAC5D,CAAC;YACF,UAAU,EAAE,IAAA,gCAAgB,EAAC;gBAC3B,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,0CAA0C;gBAC/C,iBAAiB,EAAE,sFAAsF;aAC1G,CAAC;YACF,eAAe,EAAE,IAAA,gCAAgB,EAAC;gBAChC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,iCAAiC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,mDAAmD;gBACxD,iBAAiB,EAAE,4FAA4F;aAChH,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,qCAAqC;qBACnD;oBACD,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,8CAA8C;qBAC5D;oBACD,gBAAgB,EAAE;wBAChB,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,CAAC;wBACV,WAAW,EAAE,kDAAkD;qBAChE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,KAAK;YACpB,kBAAkB,EAAE,EAAE;YACtB,gBAAgB,EAAE,GAAG;SACtB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACV,aAAa,GAAG,KAAK,EACf,gBAAgB,GAAG,GAAG,EAE3B,GAAY,OAAO,IAAI,EAAE,CAAC;QAEvB;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE;YACvD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAW,EAAE;YACpD,wBAAwB;YACxB,OAAO,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,qBAAqB;gBACpE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B;gBACnE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;QACzE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,cAAc,GAAG,CAAC,IAAsD,EAM5E,EAAE;YACF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;YAE5D,6BAA6B;YAC7B,IAAI,WAAW,GAAG,QAAQ,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvE,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,CAAC;YAED,gCAAgC;YAChC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACtE,MAAM,MAAM,GAAG,WAAW,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAE,WAAgC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAEvF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAClE,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,SAAkB,EAAwB,EAAE;YACxF,sDAAsD;YACtD,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAChD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,sCAAsC;gBACtC,OAAO;oBACL,OAAO,EAAE,SAAS;oBAClB,SAAS,EAAE,IAAI;oBACf,aAAa,EAAE,OAAO;oBACtB,eAAe,EAAE,8BAA8B;oBAC/C,OAAO,EAAE;wBACP,GAAG,EAAE,OAAO;wBACZ,IAAI,EAAE,8DAA8D;qBACrE;oBACD,MAAM,EAAE,eAAe;oBACvB,SAAS,EAAE,MAAM;iBAClB,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,eAAe;oBACxB,SAAS,EAAE,IAAI;oBACf,aAAa,EAAE,OAAO;oBACtB,eAAe,EAAE,+CAA+C;oBAChE,OAAO,EAAE;wBACP,GAAG,EAAE,OAAO;wBACZ,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,qBAAqB;qBAC7D;oBACD,MAAM,EAAE,eAAe;oBACvB,SAAS,EAAE,MAAM;iBAClB,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,wBAAwB,GAAG,CAAC,aAA4B,EAAU,EAAE;YACxE,IAAI,aAAa,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO;oBACL,oDAAoD;oBACpD,+CAA+C;oBAC/C,oEAAoE;oBACpE,qCAAqC;oBACrC,2CAA2C;iBAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;YAED,IAAI,aAAa,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;gBAC9C,OAAO;oBACL,gDAAgD;oBAChD,2DAA2D;oBAC3D,+CAA+C;oBAC/C,+CAA+C;oBAC/C,iDAAiD;iBAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;YAED,QAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;gBACpC,KAAK,OAAO;oBACV,OAAO;wBACL,mDAAmD;wBACnD,8CAA8C;wBAC9C,6CAA6C;wBAC7C,8CAA8C;wBAC9C,8CAA8C;qBAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf,KAAK,WAAW;oBACd,OAAO;wBACL,oDAAoD;wBACpD,wCAAwC;wBACxC,qDAAqD;wBACrD,uDAAuD;wBACvD,yCAAyC;qBAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEf;oBACE,OAAO;wBACL,4CAA4C;wBAC5C,2CAA2C;wBAC3C,yCAAyC;wBACzC,uCAAuC;wBACvC,yCAAyC;qBAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,aAA4B,EAAE,OAAe,EAAU,EAAE;YACnF,IAAI,aAAa,CAAC,SAAS,KAAK,UAAU,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxE,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,IAAI,aAAa,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,IAAsD,EAAE,EAAE;YACjF,qCAAqC;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YACxF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;YAExH,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO;YACT,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YAEzE,gEAAgE;YAChE,IAAI,aAAa,IAAI,WAAW,IAAI,eAAe,CAAC,WAAW,CAAC,IAAI,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBAC/F,kDAAkD;gBAClD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAE9D,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC3D,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,OAAgB;gBAC/B,eAAe,EAAE,4BAA4B;gBAC7C,OAAO,EAAE;oBACP,GAAG,EAAE,OAAO;oBACZ,IAAI,EAAE,kBAAkB;iBACzB;gBACD,MAAM,EAAE,eAAe;gBACvB,SAAS,EAAE,QAAiB;aAC7B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAEV,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;YAE/D,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI;gBACJ,SAAS,EAAE,aAAa;gBACxB,IAAI,EAAE;oBACJ,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,SAAS;oBACT,aAAa,EAAE,sBAAsB,CAAC,aAAa;oBACnD,eAAe,EAAE,sBAAsB,CAAC,eAAe;oBACvD,KAAK;oBACL,MAAM,EAAE,sBAAsB,CAAC,MAAM;iBACtC;gBACD,OAAO,EAAE;oBACP;wBACE,SAAS,EAAE,gBAAgB;wBAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,eAAe;wBAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,YAAY;wBACvB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;oBACD;wBACE,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;qBAChB;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,kBAAkB,GAAG,CAAC,IAAmB,EAAE,EAAE;YACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAEnC,2BAA2B;YAC3B,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAE1D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;oBAEtD,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,aAAa;wBACxB,IAAI,EAAE;4BACJ,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtE,SAAS;4BACT,aAAa,EAAE,aAAa,CAAC,aAAa;4BAC1C,eAAe,EAAE,aAAa,CAAC,eAAe;4BAC9C,KAAK;4BACL,MAAM,EAAE,aAAa,CAAC,MAAM;yBAC7B;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,eAAe;YAC9B,OAAO,EAAE,kBAAkB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/src/rules/security/detect-object-injection.d.ts

@@ -0,0 +1,11 @@
+export interface Options {
+    /** Allow bracket notation with literal strings. Default: false (stricter) */
+    allowLiterals?: boolean;
+    /** Additional object methods to check for injection */
+    additionalMethods?: string[];
+    /** Properties to consider dangerous. Default: __proto__, prototype, constructor */
+    dangerousProperties?: string[];
+    /** Strategy for fixing object injection: 'validate', 'whitelist', 'freeze', or 'auto' */
+    strategy?: 'validate' | 'whitelist' | 'freeze' | 'auto';
+}
+export declare const detectObjectInjection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;