eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/no-ldap-injection/index.js

@@ -1,455 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noLdapInjection = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const eslint_devkit_3 = require("@interlace/eslint-devkit");
-exports.noLdapInjection = (0, eslint_devkit_1.createRule)({
-    name: 'no-ldap-injection',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Detects LDAP injection vulnerabilities',
-        },
-        fixable: 'code',
-        hasSuggestions: true,
-        messages: {
-            ldapInjection: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'LDAP Injection',
-                cwe: 'CWE-90',
-                description: 'LDAP injection vulnerability detected',
-                severity: '{{severity}}',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
-            }),
-            unsafeLdapFilter: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Unsafe LDAP Filter',
-                cwe: 'CWE-90',
-                description: 'LDAP filter constructed with unsafe string operations',
-                severity: 'HIGH',
-                fix: 'Use ldap.escape.filterValue() to escape user input',
-                documentationLink: 'https://ldap.com/ldap-filters/',
-            }),
-            unescapedLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Unescaped LDAP Input',
-                cwe: 'CWE-90',
-                description: 'LDAP operation uses unescaped user input',
-                severity: 'MEDIUM',
-                fix: 'Escape all user input before LDAP operations',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
-            }),
-            dangerousLdapOperation: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Dangerous LDAP Operation',
-                cwe: 'CWE-90',
-                description: 'LDAP operation allows dangerous filter patterns',
-                severity: 'HIGH',
-                fix: 'Validate LDAP filters and restrict allowed operations',
-                documentationLink: 'https://ldap.com/ldap-filters/',
-            }),
-            useLdapEscaping: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Use LDAP Escaping',
-                description: 'Use proper LDAP escaping functions',
-                severity: 'LOW',
-                fix: 'Use ldap.escape.filterValue() or equivalent',
-                documentationLink: 'https://www.npmjs.com/package/ldap-escape',
-            }),
-            validateLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Validate LDAP Input',
-                description: 'Validate LDAP input before processing',
-                severity: 'LOW',
-                fix: 'Validate input against allowed patterns',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
-            }),
-            useParameterizedLdap: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Use Parameterized LDAP',
-                description: 'Use parameterized LDAP queries when possible',
-                severity: 'LOW',
-                fix: 'Use prepared LDAP statements or safe construction',
-                documentationLink: 'https://ldap.com/ldap-filters/',
-            }),
-            strategyInputValidation: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Input Validation Strategy',
-                description: 'Validate LDAP input at application boundary',
-                severity: 'LOW',
-                fix: 'Implement input validation and length limits',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
-            }),
-            strategySafeLibraries: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Safe Libraries Strategy',
-                description: 'Use LDAP libraries with built-in escaping',
-                severity: 'LOW',
-                fix: 'Use ldapjs or libraries with automatic escaping',
-                documentationLink: 'https://www.npmjs.com/package/ldapjs',
-            }),
-            strategyFilterConstruction: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Filter Construction Strategy',
-                description: 'Use safe LDAP filter construction methods',
-                severity: 'LOW',
-                fix: 'Build filters programmatically with escaped values',
-                documentationLink: 'https://ldap.com/ldap-filters/',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    ldapFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
-                    },
-                    ldapEscapeFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
-                    },
-                    ldapValidationFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional function names to consider as LDAP sanitizers',
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional JSDoc annotations to consider as safe markers',
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Disable all false positive detection (strict mode)',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            ldapFunctions: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
-            ldapEscapeFunctions: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
-            ldapValidationFunctions: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { ldapFunctions = ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'], ldapEscapeFunctions = ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'], ldapValidationFunctions = ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
-        const sourceCode = context.sourceCode || context.sourceCode;
-        const filename = context.filename || context.filename;
-        // Create safety checker for false positive detection
-        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
-            trustedSanitizers,
-            trustedAnnotations,
-            trustedOrmPatterns: [],
-            strictMode,
-        });
-        /**
-         * Check if this is an LDAP-related operation
-         */
-        const isLdapOperation = (node) => {
-            const callee = node.callee;
-            // Check for LDAP method calls
-            if (callee.type === 'MemberExpression' &&
-                callee.property.type === 'Identifier' &&
-                ldapFunctions.includes(callee.property.name)) {
-                return true;
-            }
-            return false;
-        };
-        /**
-         * Check if LDAP filter contains dangerous patterns
-         */
-        const containsDangerousLdapFilter = (filterText) => {
-            // Dangerous LDAP filter patterns
-            const dangerousPatterns = [
-                /\*\)$/, // Ending with *) to match everything
-                /\|\)$/, // Ending with |) for OR operations
-                /&\)$/, // Ending with &) for AND operations
-                /!\)$/, // Ending with !) for NOT operations
-                /\*\|\*/, // *|* pattern for matching everything
-                /\*&\*/, // *&* pattern
-                /\*!/, // NOT operations that could be exploited
-            ];
-            return dangerousPatterns.some(pattern => pattern.test(filterText));
-        };
-        /**
-         * Check if string contains LDAP filter interpolation
-         */
-        const containsLdapInterpolation = (text) => {
-            return /\$\{[^}]+\}/.test(text) || /'[^']*\+[^+]*'/.test(text) || /"[^"]*\+[^+]*"/.test(text);
-        };
-        /**
-         * Check if LDAP input is from untrusted source
-         */
-        const isUntrustedLdapInput = (inputNode) => {
-            // Check member expressions like req.query.name, req.params.id, etc.
-            if (inputNode.type === 'MemberExpression') {
-                const fullName = sourceCode.getText(inputNode).toLowerCase();
-                return fullName.includes('req.') || fullName.includes('request.') ||
-                    fullName.includes('query.') || fullName.includes('params.') ||
-                    fullName.includes('body.');
-            }
-            // In test contexts, also consider certain variable names as potentially untrusted
-            if (inputNode.type === 'Identifier') {
-                const varName = inputNode.name.toLowerCase();
-                return ['userid', 'username', 'userinput', 'input', 'term', 'name', 'search', 'query', 'param', 'password', 'id', 'dn'].includes(varName) ||
-                    varName.startsWith('user') || varName.startsWith('input') || varName.endsWith('input') ||
-                    varName.includes('user') || varName.includes('input');
-            }
-            return false;
-        };
-        /**
-         * Check if LDAP input has been escaped
-         */
-        const isLdapInputEscaped = (inputNode) => {
-            let current = inputNode;
-            while (current) {
-                if (current.type === 'CallExpression') {
-                    const callee = current.callee;
-                    // Check for escape function calls
-                    if (callee.type === 'MemberExpression' &&
-                        callee.property.type === 'Identifier') {
-                        const propertyName = callee.property.name;
-                        if (ldapEscapeFunctions.some(escapeFunc => escapeFunc.includes(propertyName) ||
-                            propertyName.includes('escape'))) {
-                            return true;
-                        }
-                    }
-                    // Check for validation function calls
-                    if (callee.type === 'Identifier' &&
-                        ldapValidationFunctions.includes(callee.name)) {
-                        return true;
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        };
-        return {
-            // Check LDAP function calls
-            CallExpression(node) {
-                if (!isLdapOperation(node)) {
-                    return;
-                }
-                const args = node.arguments;
-                if (args.length < 2) {
-                    return; // Need at least base DN and filter/options
-                }
-                // Check filter argument (usually the second argument)
-                const filterArg = args[1];
-                // Check if filter argument comes from untrusted input (like req.query.filter)
-                if (isUntrustedLdapInput(filterArg)) {
-                    /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                    if (safetyChecker.isSafe(filterArg, context)) {
-                        return;
-                    }
-                    /* c8 ignore stop */
-                    context.report({
-                        node: filterArg,
-                        messageId: 'unescapedLdapInput',
-                        data: {
-                            filePath: filename,
-                            line: String(node.loc?.start.line ?? 0),
-                        },
-                        suggest: [
-                            {
-                                messageId: 'useLdapEscaping',
-                                fix: () => null,
-                            },
-                        ],
-                    });
-                }
-                else if (filterArg.type === 'TemplateLiteral' && filterArg.expressions.length > 0) {
-                    // Special handling for template literals with any expressions in LDAP calls
-                    // This is a more aggressive check for LDAP injection in function calls
-                    const hasAnyExpression = filterArg.expressions.some(() => true);
-                    if (hasAnyExpression) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(filterArg, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: filterArg,
-                            messageId: 'unescapedLdapInput',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                            suggest: [
-                                {
-                                    messageId: 'useLdapEscaping',
-                                    fix: () => null,
-                                },
-                            ],
-                        });
-                    }
-                }
-            },
-            // Check variable declarations with LDAP filters
-            VariableDeclarator(node) {
-                if (!node.init || node.id.type !== 'Identifier') {
-                    return;
-                }
-                const varName = node.id.name.toLowerCase();
-                // Check if variable name suggests LDAP-related content
-                const isLdapRelated = varName.includes('filter') || varName.includes('ldap') ||
-                    varName.includes('query') || varName.includes('search') ||
-                    varName.includes('dn') || varName.includes('bind');
-                // If not obviously LDAP-related, check if the assigned value looks like LDAP
-                if (!isLdapRelated && node.init) {
-                    const initText = sourceCode.getText(node.init);
-                    if (!initText.includes('(') || !initText.includes(')')) {
-                        return;
-                    }
-                }
-                // Check if assigned value contains dangerous LDAP patterns
-                if (node.init.type === 'Literal' && typeof node.init.value === 'string') {
-                    if (containsDangerousLdapFilter(node.init.value)) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(node.init, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: node.init,
-                            messageId: 'dangerousLdapOperation',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                }
-                else if (node.init.type === 'TemplateLiteral') {
-                    // Handle template literals with interpolation
-                    const fullText = sourceCode.getText(node.init);
-                    // Check for interpolation in LDAP-like expressions
-                    if (containsLdapInterpolation(fullText)) {
-                        // Check if any interpolated values are untrusted
-                        const hasUntrustedInterpolation = node.init.expressions.some((expr) => isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr));
-                        if (hasUntrustedInterpolation) {
-                            /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                            if (safetyChecker.isSafe(node.init, context)) {
-                                return;
-                            }
-                            /* c8 ignore stop */
-                            context.report({
-                                node: node.init,
-                                messageId: 'unsafeLdapFilter',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                                suggest: [
-                                    {
-                                        messageId: 'useLdapEscaping',
-                                        fix: () => null,
-                                    },
-                                ],
-                            });
-                        }
-                    }
-                    // Check for dangerous patterns in template literals
-                    if (containsDangerousLdapFilter(fullText)) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(node.init, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: node.init,
-                            messageId: 'dangerousLdapOperation',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                }
-                else if (node.init.type === 'BinaryExpression' && node.init.operator === '+') {
-                    // Handle string concatenation
-                    const fullText = sourceCode.getText(node.init);
-                    // Check if this looks like LDAP filter construction
-                    if (fullText.includes('(') && fullText.includes(')')) {
-                        // Check if untrusted input is involved (recursive check)
-                        const hasUntrustedInput = (expr) => {
-                            if (isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr)) {
-                                return true;
-                            }
-                            if (expr.type === 'BinaryExpression' && expr.operator === '+') {
-                                return hasUntrustedInput(expr.left) || hasUntrustedInput(expr.right);
-                            }
-                            return false;
-                        };
-                        if (hasUntrustedInput(node.init.left) || hasUntrustedInput(node.init.right)) {
-                            /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                            if (safetyChecker.isSafe(node.init, context)) {
-                                return;
-                            }
-                            /* c8 ignore stop */
-                            context.report({
-                                node: node.init,
-                                messageId: 'ldapInjection',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                    severity: 'HIGH',
-                                    safeAlternative: 'Use ldap.escape.filterValue() or parameterized LDAP queries',
-                                },
-                                suggest: [
-                                    {
-                                        messageId: 'useLdapEscaping',
-                                        fix: () => null,
-                                    },
-                                ],
-                            });
-                        }
-                    }
-                }
-                else if (isUntrustedLdapInput(node.init) && !isLdapInputEscaped(node.init)) {
-                    /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                    if (safetyChecker.isSafe(node.init, context)) {
-                        return;
-                    }
-                    /* c8 ignore stop */
-                    context.report({
-                        node: node.init,
-                        messageId: 'ldapInjection',
-                        data: {
-                            filePath: filename,
-                            line: String(node.loc?.start.line ?? 0),
-                            severity: 'MEDIUM',
-                            safeAlternative: 'Use proper LDAP escaping and validation',
-                        },
-                        suggest: [
-                            {
-                                messageId: 'useLdapEscaping',
-                                fix: () => null,
-                            },
-                        ],
-                    });
-                }
-            }
-        };
-    },
-});

package/src/rules/no-missing-authentication/index.d.ts

@@ -1,13 +0,0 @@
-export interface Options {
-    /** Allow missing authentication in test files. Default: false */
-    allowInTests?: boolean;
-    /** Test file pattern regex string. Default: '\\.(test|spec)\\.(ts|tsx|js|jsx)$' */
-    testFilePattern?: string;
-    /** Authentication middleware patterns to recognize. Default: ['authenticate', 'auth', 'requireAuth', 'isAuthenticated'] */
-    authMiddlewarePatterns?: string[];
-    /** Route handler patterns to check. Default: ['get', 'post', 'put', 'delete', 'patch', 'all'] */
-    routeHandlerPatterns?: string[];
-    /** Additional patterns to ignore. Default: [] */
-    ignorePatterns?: string[];
-}
-export declare const noMissingAuthentication: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;