eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/no-missing-cors-check/index.js

@@ -1,399 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noMissingCorsCheck = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-/**
- * Check if a string matches any ignore pattern
- */
-function matchesIgnorePattern(text, ignorePatterns) {
-    return ignorePatterns.some(pattern => {
-        try {
-            const regex = new RegExp(pattern, 'i');
-            return regex.test(text);
-        }
-        catch {
-            return false;
-        }
-    });
-}
-exports.noMissingCorsCheck = (0, eslint_devkit_2.createRule)({
-    name: 'no-missing-cors-check',
-    meta: {
-        type: 'problem',
-        deprecated: true,
-        replacedBy: ['@see eslint-plugin-express-security/no-permissive-cors'],
-        docs: {
-            description: 'Detects missing CORS validation (wildcard CORS, missing origin check)',
-        },
-        hasSuggestions: true,
-        messages: {
-            missingCorsCheck: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing CORS Validation',
-                cwe: 'CWE-346',
-                description: 'Missing CORS validation detected: {{issue}}',
-                severity: 'HIGH',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/346.html',
-            }),
-            useOriginValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Validate Origin',
-                description: 'Validate CORS origin',
-                severity: 'LOW',
-                fix: 'cors({ origin: (origin, cb) => allowedOrigins.includes(origin) ? cb(null, true) : cb(new Error()) })',
-                documentationLink: 'https://github.com/expressjs/cors#configuration-options',
-            }),
-            useCorsMiddleware: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use CORS Middleware',
-                description: 'Use CORS middleware with origin validation',
-                severity: 'LOW',
-                fix: 'app.use(cors({ origin: allowedOrigins }))',
-                documentationLink: 'https://github.com/expressjs/cors',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow missing CORS checks in test files',
-                    },
-                    trustedLibraries: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Custom CORS libraries to trust (wildcard origins in these libraries will not be reported)',
-                    },
-                    ignorePatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional safe patterns to ignore',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-            trustedLibraries: [], // Empty by default - users can add custom CORS libraries they trust
-            ignorePatterns: [],
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false, trustedLibraries: corsTrustedLibraries = [], ignorePatterns = [], } = options;
-        const trustedLibraries = corsTrustedLibraries;
-        const filename = context.getFilename();
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        const sourceCode = context.sourceCode || context.sourceCode;
-        function checkLiteral(node) {
-            if (isTestFile) {
-                return;
-            }
-            // Check for wildcard CORS origin
-            if (node.value === '*' && typeof node.value === 'string') {
-                const text = sourceCode.getText(node);
-                // Check if it matches any ignore pattern
-                if (matchesIgnorePattern(text, ignorePatterns)) {
-                    return;
-                }
-                // Check if it's in contexts handled by other checkers
-                // 1. setHeader/header calls - checkMemberExpression handles these
-                // 2. app.use(cors({ origin: "*" })) - checkCallExpression handles these with suggestions
-                let shouldSkip = false;
-                let current = node;
-                while (current && current.parent) {
-                    current = current.parent;
-                    if (current.type === 'CallExpression') {
-                        const callText = sourceCode.getText(current);
-                        // Check if it's a setHeader/header call with Access-Control-Allow-Origin
-                        // Skip these - checkMemberExpression handles them
-                        if (/\b(setHeader|header)\s*\(/i.test(callText) && /\bAccess-Control-Allow-Origin\b/i.test(callText)) {
-                            shouldSkip = true;
-                            break;
-                        }
-                        // Check if it's app.use(cors({ origin: "*" })) - checkCallExpression handles these with suggestions
-                        if (/\buse\s*\(/i.test(callText) && /\bcors\s*\(/i.test(callText)) {
-                            // Check if the literal is in an object property named "origin"
-                            if (node.parent && node.parent.type === 'Property') {
-                                const prop = node.parent;
-                                if (prop.key.type === 'Identifier' && prop.key.name === 'origin') {
-                                    shouldSkip = true;
-                                    break;
-                                }
-                            }
-                        }
-                    }
-                }
-                // Skip if it's in a context handled by another checker
-                if (shouldSkip) {
-                    return;
-                }
-                // Check if it's in a CORS-related context
-                // Only report if it's actually in a CORS configuration (app.use(cors(...)), etc.)
-                // Not just any object with origin: "*"
-                let isActualCorsContext = false;
-                // Check if it's in app.use(cors(...)) or similar
-                current = node;
-                while (current && current.parent) {
-                    current = current.parent;
-                    if (current.type === 'CallExpression') {
-                        const callText = sourceCode.getText(current);
-                        // Check if it's a CORS middleware call
-                        if (/\b(use|cors)\s*\(/i.test(callText) && /\bcors\s*\(/i.test(callText)) {
-                            isActualCorsContext = true;
-                            break;
-                        }
-                    }
-                }
-                // Also check if it's in an object property with name "origin" or "allowedOrigins"
-                // but only if it's in a CORS-related call expression
-                if (node.parent && node.parent.type === 'Property') {
-                    const prop = node.parent;
-                    if (prop.key.type === 'Identifier') {
-                        const keyName = prop.key.name.toLowerCase();
-                        if (keyName === 'origin' || keyName === 'allowedorigins') {
-                            // Check if this property is in a CORS call context
-                            let inCorsCall = false;
-                            let checkNode = prop;
-                            while (checkNode && checkNode.parent) {
-                                checkNode = checkNode.parent;
-                                if (checkNode.type === 'CallExpression') {
-                                    const callText = sourceCode.getText(checkNode);
-                                    if (/\bcors\s*\(/i.test(callText) ||
-                                        (/\buse\s*\(/i.test(callText) && /\bcors/i.test(callText))) {
-                                        inCorsCall = true;
-                                        break;
-                                    }
-                                }
-                            }
-                            if (inCorsCall) {
-                                // Always report wildcard CORS origin - it's never safe
-                                context.report({
-                                    node,
-                                    messageId: 'missingCorsCheck',
-                                    data: {
-                                        issue: 'Wildcard CORS origin (*) allows all origins',
-                                        safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
-                                    },
-                                    suggest: [
-                                        {
-                                            messageId: 'useOriginValidation',
-                                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                            fix: (_fixer) => null,
-                                        },
-                                    ],
-                                });
-                                return;
-                            }
-                        }
-                    }
-                }
-                // Only report if it's in an actual CORS context
-                if (isActualCorsContext) {
-                    // Always report wildcard CORS origin - it's never safe
-                    context.report({
-                        node,
-                        messageId: 'missingCorsCheck',
-                        data: {
-                            issue: 'Wildcard CORS origin (*) allows all origins',
-                            safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
-                        },
-                        suggest: [
-                            {
-                                messageId: 'useOriginValidation',
-                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                fix: (_fixer) => null,
-                            },
-                        ],
-                    });
-                }
-            }
-        }
-        function checkCallExpression(node) {
-            if (isTestFile) {
-                return;
-            }
-            // Check for app.use(cors({ origin: "*" })) or similar
-            if (node.callee.type === 'MemberExpression') {
-                const property = node.callee.property;
-                if (property.type === 'Identifier' && property.name === 'use') {
-                    // Check if CORS is being used
-                    const text = sourceCode.getText(node);
-                    // Check if it matches any ignore pattern
-                    if (matchesIgnorePattern(text, ignorePatterns)) {
-                        return;
-                    }
-                    // Check if it's a CORS middleware call
-                    // Check for cors() or trusted library calls
-                    const firstArg = node.arguments.length > 0 ? node.arguments[0] : null;
-                    let isCorsCall = /\bcors\s*\(/i.test(text);
-                    if (!isCorsCall && firstArg && firstArg.type === 'CallExpression' && firstArg.callee.type === 'Identifier') {
-                        const callee = firstArg.callee;
-                        const calleeName = callee.name.toLowerCase();
-                        // Check if it's the standard 'cors' library or a trusted library
-                        isCorsCall = calleeName === 'cors' || trustedLibraries.some(lib => {
-                            return calleeName.includes(lib.toLowerCase());
-                        });
-                    }
-                    // Check if it's a trusted library - skip if explicitly trusted
-                    let isTrustedLibrary = false;
-                    if (firstArg && firstArg.type === 'CallExpression' && firstArg.callee.type === 'Identifier') {
-                        const calleeName = firstArg.callee.name.toLowerCase();
-                        isTrustedLibrary = trustedLibraries.some(lib => calleeName.includes(lib.toLowerCase()));
-                    }
-                    if (isTrustedLibrary) {
-                        return; // Trusted library, skip
-                    }
-                    // Check if it's a CORS call
-                    if (/\bcors\s*\(/i.test(text) || isCorsCall) {
-                        // Check arguments for wildcard origin
-                        // For app.use(cors({ origin: "*" })), we need to check the arguments to cors(), not app.use()
-                        const corsCallArg = firstArg && firstArg.type === 'CallExpression' ? firstArg : null;
-                        const argsToCheck = corsCallArg ? corsCallArg.arguments : node.arguments;
-                        for (const arg of argsToCheck) {
-                            if (arg.type === 'ObjectExpression') {
-                                // Check for origin property with wildcard value
-                                for (const prop of arg.properties) {
-                                    if (prop.type === 'Property' &&
-                                        prop.key.type === 'Identifier' &&
-                                        prop.key.name === 'origin' &&
-                                        prop.value.type === 'Literal' &&
-                                        prop.value.value === '*') {
-                                        context.report({
-                                            node: prop.value,
-                                            messageId: 'missingCorsCheck',
-                                            data: {
-                                                issue: 'Wildcard CORS origin (*) allows all origins',
-                                                safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
-                                            },
-                                            suggest: [
-                                                {
-                                                    messageId: 'useOriginValidation',
-                                                    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                                    fix: (_fixer) => null,
-                                                },
-                                            ],
-                                        });
-                                    }
-                                }
-                            }
-                            else if (arg.type === 'Identifier') {
-                                // Check if this identifier was assigned an object literal with origin: "*"
-                                // For cases like: const config = { origin: "*" }; app.use(cors(config));
-                                const varName = arg.name;
-                                // Traverse the AST to find the variable declaration
-                                let current = node;
-                                while (current) {
-                                    if (current.type === 'Program' || current.type === 'FunctionDeclaration' || current.type === 'FunctionExpression' || current.type === 'ArrowFunctionExpression') {
-                                        // Search for variable declarations in this scope
-                                        const scopeBody = current.type === 'Program' ? current.body :
-                                            (current.type === 'FunctionDeclaration' || current.type === 'FunctionExpression' || current.type === 'ArrowFunctionExpression') ?
-                                                (current.body.type === 'BlockStatement' ? current.body.body : []) : [];
-                                        for (const stmt of scopeBody) {
-                                            if (stmt.type === 'VariableDeclaration') {
-                                                for (const declarator of stmt.declarations) {
-                                                    if (declarator.id.type === 'Identifier' && declarator.id.name === varName && declarator.init) {
-                                                        // Check if init is an object literal with origin: "*"
-                                                        if (declarator.init.type === 'ObjectExpression') {
-                                                            for (const prop of declarator.init.properties) {
-                                                                if (prop.type === 'Property' &&
-                                                                    prop.key.type === 'Identifier' &&
-                                                                    prop.key.name === 'origin' &&
-                                                                    prop.value.type === 'Literal' &&
-                                                                    prop.value.value === '*') {
-                                                                    context.report({
-                                                                        node: arg,
-                                                                        messageId: 'missingCorsCheck',
-                                                                        data: {
-                                                                            issue: 'Wildcard CORS origin (*) allows all origins',
-                                                                            safeAlternative: 'Use origin validation: app.use(cors({ origin: (origin, callback) => { if (allowedOrigins.includes(origin)) callback(null, true); else callback(new Error("Not allowed")); } } }));',
-                                                                        },
-                                                                        suggest: [
-                                                                            {
-                                                                                messageId: 'useOriginValidation',
-                                                                                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                                                                fix: (_fixer) => null,
-                                                                            },
-                                                                        ],
-                                                                    });
-                                                                    return; // Found and reported, exit
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                        break; // Only check the immediate scope
-                                    }
-                                    if (current.parent) {
-                                        current = current.parent;
-                                    }
-                                    else {
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        function checkMemberExpression(node) {
-            if (isTestFile) {
-                return;
-            }
-            // Check for Access-Control-Allow-Origin header without validation
-            if (node.property.type === 'Identifier') {
-                const propertyName = node.property.name;
-                if (propertyName === 'setHeader' || propertyName === 'header') {
-                    // Check if it matches any ignore pattern
-                    const text = sourceCode.getText(node);
-                    if (matchesIgnorePattern(text, ignorePatterns)) {
-                        return;
-                    }
-                    // Check if it's setting CORS headers
-                    // Need to check the full call expression, not just the member expression
-                    const parent = node.parent;
-                    if (parent && parent.type === 'CallExpression') {
-                        const callText = sourceCode.getText(parent);
-                        if (/\bAccess-Control-Allow-Origin\b/i.test(callText)) {
-                            // Check if the value is a wildcard
-                            const args = parent.arguments;
-                            if (args.length >= 2 && args[1].type === 'Literal' && args[1].value === '*') {
-                                context.report({
-                                    node: args[1],
-                                    messageId: 'missingCorsCheck',
-                                    data: {
-                                        issue: 'Wildcard CORS header allows all origins',
-                                        safeAlternative: 'Validate origin before setting header: res.setHeader("Access-Control-Allow-Origin", allowedOrigins.includes(origin) ? origin : "null");',
-                                    },
-                                    suggest: [
-                                        {
-                                            messageId: 'useOriginValidation',
-                                            // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                                            fix: (_fixer) => null,
-                                        },
-                                    ],
-                                });
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return {
-            Literal: checkLiteral,
-            CallExpression: checkCallExpression,
-            MemberExpression: checkMemberExpression,
-        };
-    },
-});

package/src/rules/no-missing-csrf-protection/index.d.ts

@@ -1,11 +0,0 @@
-export interface Options {
-    /** Allow missing CSRF protection in test files. Default: false */
-    allowInTests?: boolean;
-    /** CSRF middleware patterns to recognize. Default: ['csrf', 'csurf', 'csrfProtection', 'verifyCsrfToken'] */
-    csrfMiddlewarePatterns?: string[];
-    /** HTTP methods that require CSRF protection. Default: ['post', 'put', 'delete', 'patch'] */
-    protectedMethods?: string[];
-    /** Additional safe patterns to ignore. Default: [] */
-    ignorePatterns?: string[];
-}
-export declare const noMissingCsrfProtection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;

package/src/rules/no-missing-csrf-protection/index.js

@@ -1,180 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noMissingCsrfProtection = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-/**
- * Default CSRF middleware patterns
- */
-const DEFAULT_CSRF_MIDDLEWARE_PATTERNS = [
-    'csrf',
-    'csurf',
-    'csrfProtection',
-    'verifyCsrfToken',
-    'csrfToken',
-    'validateCsrf',
-    'checkCsrf',
-    'csrfMiddleware',
-];
-/**
- * Default HTTP methods that require CSRF protection
- */
-const DEFAULT_PROTECTED_METHODS = ['post', 'put', 'delete', 'patch'];
-/**
- * Check if a string matches any ignore pattern
- */
-function matchesIgnorePattern(text, patterns) {
-    return patterns.some(pattern => {
-        try {
-            const regex = new RegExp(pattern, 'i');
-            return regex.test(text);
-        }
-        catch {
-            return text.toLowerCase().includes(pattern.toLowerCase());
-        }
-    });
-}
-exports.noMissingCsrfProtection = (0, eslint_devkit_2.createRule)({
-    name: 'no-missing-csrf-protection',
-    meta: {
-        type: 'problem',
-        deprecated: true,
-        replacedBy: ['@see eslint-plugin-express-security/require-csrf-protection'],
-        docs: {
-            description: 'Detects missing CSRF token validation in POST/PUT/DELETE requests',
-        },
-        hasSuggestions: true,
-        messages: {
-            missingCsrfProtection: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing CSRF Protection',
-                cwe: 'CWE-352',
-                description: 'Missing CSRF protection detected: {{issue}}',
-                severity: 'HIGH',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/352.html',
-            }),
-            addCsrfValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Add CSRF Validation',
-                description: 'Add CSRF middleware',
-                severity: 'LOW',
-                fix: 'app.use(csrf({ cookie: true }))',
-                documentationLink: 'https://github.com/expressjs/csurf',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowInTests: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow missing CSRF protection in test files',
-                    },
-                    csrfMiddlewarePatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'CSRF middleware patterns to recognize',
-                    },
-                    protectedMethods: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'HTTP methods that require CSRF protection',
-                    },
-                    ignorePatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional safe patterns to ignore',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowInTests: false,
-            csrfMiddlewarePatterns: [],
-            protectedMethods: [],
-            ignorePatterns: [],
-        },
-    ],
-    create(context, [options = {}]) {
-        const { allowInTests = false, csrfMiddlewarePatterns, protectedMethods: customProtectedMethods, ignorePatterns = [], } = options;
-        const csrfPatterns = csrfMiddlewarePatterns && csrfMiddlewarePatterns.length > 0
-            ? csrfMiddlewarePatterns
-            : DEFAULT_CSRF_MIDDLEWARE_PATTERNS;
-        const protectedMethods = customProtectedMethods && customProtectedMethods.length > 0
-            ? customProtectedMethods
-            : DEFAULT_PROTECTED_METHODS;
-        // Pre-compute Set for O(1) lookups (performance optimization)
-        const protectedMethodsSet = new Set(protectedMethods.map(m => m.toLowerCase()));
-        const filename = context.filename;
-        const isTestFile = allowInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
-        const sourceCode = context.sourceCode;
-        function checkCallExpression(node) {
-            if (isTestFile) {
-                return;
-            }
-            const callee = node.callee;
-            const callText = sourceCode.getText(node);
-            // Check if it matches any ignore pattern
-            if (matchesIgnorePattern(callText, ignorePatterns)) {
-                return;
-            }
-            // Check for route handler methods (app.post, router.put, etc.)
-            if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression && callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
-                const methodName = callee.property.name;
-                // Only check if it's a route handler that requires CSRF (O(1) Set lookup)
-                if (protectedMethodsSet.has(methodName.toLowerCase())) {
-                    // Must have at least 2 arguments (path and handler)
-                    if (node.arguments.length < 2) {
-                        return;
-                    }
-                    // Check if CSRF middleware is in the route chain arguments
-                    let hasCsrfInChain = false;
-                    // Check if any argument (after the first path argument) is a CSRF middleware
-                    // Skip the first argument (path) and check the rest
-                    for (let i = 1; i < node.arguments.length; i++) {
-                        const arg = node.arguments[i];
-                        const argText = sourceCode.getText(arg);
-                        if (csrfPatterns.some(pattern => argText.toLowerCase().includes(pattern.toLowerCase()))) {
-                            hasCsrfInChain = true;
-                            break;
-                        }
-                    }
-                    if (!hasCsrfInChain) {
-                        context.report({
-                            node,
-                            messageId: 'missingCsrfProtection',
-                            data: {
-                                issue: `${methodName.toUpperCase()} route handler missing CSRF protection`,
-                                safeAlternative: `Add CSRF middleware: app.${methodName}("/path", csrf(), handler) or use app.use(csrf()) globally`,
-                            },
-                            suggest: [
-                                {
-                                    messageId: 'addCsrfValidation',
-                                    fix(fixer) {
-                                        // Add CSRF middleware after the first argument (path)
-                                        const firstArg = node.arguments[0];
-                                        if (firstArg) {
-                                            return fixer.insertTextAfter(firstArg, ', csrf()');
-                                        }
-                                        return null;
-                                    },
-                                },
-                            ],
-                        });
-                    }
-                }
-            }
-        }
-        return {
-            CallExpression: checkCallExpression,
-        };
-    },
-});

package/src/rules/no-missing-security-headers/index.d.ts

@@ -1,7 +0,0 @@
-export interface Options {
-    /** Required security headers. Default: ['Content-Security-Policy', 'X-Frame-Options', 'X-Content-Type-Options'] */
-    requiredHeaders?: string[];
-    /** Ignore in test files. Default: true */
-    ignoreInTests?: boolean;
-}
-export declare const noMissingSecurityHeaders: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;