eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/no-weak-password-recovery/index.js

@@ -1,424 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noWeakPasswordRecovery = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const eslint_devkit_3 = require("@interlace/eslint-devkit");
-exports.noWeakPasswordRecovery = (0, eslint_devkit_1.createRule)({
-    name: 'no-weak-password-recovery',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Detects weak password recovery mechanisms',
-        },
-        fixable: 'code',
-        hasSuggestions: true,
-        messages: {
-            weakPasswordRecovery: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Weak Password Recovery',
-                cwe: 'CWE-640',
-                description: 'Password recovery mechanism has security weaknesses',
-                severity: '{{severity}}',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            missingRateLimit: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Missing Rate Limit',
-                cwe: 'CWE-640',
-                description: 'Password recovery attempts not rate limited',
-                severity: 'HIGH',
-                fix: 'Implement rate limiting on recovery requests',
-                documentationLink: 'https://owasp.org/www-community/attacks/Brute_force_attack',
-            }),
-            predictableRecoveryToken: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Predictable Recovery Token',
-                cwe: 'CWE-640',
-                description: 'Recovery token can be predicted or guessed',
-                severity: 'CRITICAL',
-                fix: 'Use cryptographically secure random tokens',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            unlimitedRecoveryAttempts: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Unlimited Recovery Attempts',
-                cwe: 'CWE-640',
-                description: 'No limit on password recovery attempts',
-                severity: 'MEDIUM',
-                fix: 'Limit recovery attempts per time period',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            insufficientTokenEntropy: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Insufficient Token Entropy',
-                cwe: 'CWE-640',
-                description: 'Recovery token has insufficient randomness',
-                severity: 'HIGH',
-                fix: 'Use at least 128-bit entropy for tokens',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            missingTokenExpiration: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Missing Token Expiration',
-                cwe: 'CWE-640',
-                description: 'Recovery tokens never expire',
-                severity: 'HIGH',
-                fix: 'Implement token expiration (15-60 minutes)',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            recoveryLoggingSensitiveData: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Recovery Logging Sensitive Data',
-                cwe: 'CWE-640',
-                description: 'Logging sensitive data during password recovery',
-                severity: 'MEDIUM',
-                fix: 'Never log passwords, tokens, or sensitive recovery data',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            weakRecoveryVerification: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Weak Recovery Verification',
-                cwe: 'CWE-640',
-                description: 'Recovery request verification is insufficient',
-                severity: 'HIGH',
-                fix: 'Require strong verification (email + SMS, security questions)',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            tokenReuseVulnerability: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.SECURITY,
-                issueName: 'Token Reuse Vulnerability',
-                cwe: 'CWE-640',
-                description: 'Recovery tokens can be reused',
-                severity: 'HIGH',
-                fix: 'Mark tokens as used after successful recovery',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            implementRateLimiting: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Implement Rate Limiting',
-                description: 'Add rate limiting to recovery endpoints',
-                severity: 'LOW',
-                fix: 'Limit recovery attempts to 5 per hour per IP/user',
-                documentationLink: 'https://owasp.org/www-community/attacks/Brute_force_attack',
-            }),
-            useCryptographicallySecureTokens: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Use Cryptographically Secure Tokens',
-                description: 'Generate tokens with crypto.randomBytes()',
-                severity: 'LOW',
-                fix: 'const token = crypto.randomBytes(32).toString("hex");',
-                documentationLink: 'https://nodejs.org/api/crypto.html#cryptorandombytessize-callback',
-            }),
-            implementTokenExpiration: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Implement Token Expiration',
-                description: 'Set reasonable token expiration times',
-                severity: 'LOW',
-                fix: 'Expire tokens after 15-60 minutes',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            }),
-            secureRecoveryFlow: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.INFO,
-                issueName: 'Secure Recovery Flow',
-                description: 'Implement secure password recovery flow',
-                severity: 'LOW',
-                fix: 'Verify identity, send secure link, require current password',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html',
-            }),
-            strategyMultiFactor: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Multi-Factor Strategy',
-                description: 'Require multiple verification factors',
-                severity: 'LOW',
-                fix: 'Email + SMS verification for password recovery',
-                documentationLink: 'https://owasp.org/www-community/attacks/Brute_force_attack',
-            }),
-            strategyOutOfBandVerification: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Out-of-Band Verification Strategy',
-                description: 'Use out-of-band verification channels',
-                severity: 'LOW',
-                fix: 'Send recovery codes via SMS or authenticator app',
-                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html',
-            }),
-            strategyTimeBoundTokens: (0, eslint_devkit_2.formatLLMMessage)({
-                icon: eslint_devkit_2.MessageIcons.STRATEGY,
-                issueName: 'Time-Bound Tokens Strategy',
-                description: 'Use time-bound recovery tokens',
-                severity: 'LOW',
-                fix: 'Tokens expire quickly and can only be used once',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/640.html',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    minTokenEntropy: {
-                        type: 'number',
-                        minimum: 64,
-                        default: 128,
-                    },
-                    maxTokenLifetimeHours: {
-                        type: 'number',
-                        minimum: 0.25,
-                        default: 1,
-                    },
-                    recoveryKeywords: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['reset', 'password', 'recovery', 'forgot', 'token', 'resetToken'],
-                    },
-                    secureTokenFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: ['crypto.randomBytes', 'crypto.randomUUID', 'randomBytes', 'generateSecureToken'],
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional function names to consider as secure',
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional JSDoc annotations to consider as safe markers',
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Disable all false positive detection (strict mode)',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            minTokenEntropy: 128,
-            maxTokenLifetimeHours: 1,
-            recoveryKeywords: ['reset', 'password', 'recovery', 'forgot', 'token', 'resetToken'],
-            secureTokenFunctions: ['crypto.randomBytes', 'crypto.randomUUID', 'randomBytes', 'generateSecureToken'],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { secureTokenFunctions = ['crypto.randomBytes', 'crypto.randomUUID', 'randomBytes', 'generateSecureToken'], trustedSanitizers = [], trustedAnnotations = ['secure-recovery', 'rate-limited'], strictMode = false, } = options;
-        const sourceCode = context.sourceCode || context.sourceCode;
-        const filename = context.filename || context.getFilename();
-        // Create safety checker for false positive detection
-        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
-            trustedSanitizers,
-            trustedAnnotations,
-            trustedOrmPatterns: [],
-            strictMode,
-        });
-        /**
-         * Check if code is specifically related to password recovery
-         * Requires MULTIPLE indicators to avoid false positives on general password handling
-         * Only returns true for functions that BOTH:
-         * 1. Have password/forgot in the name
-         * 2. AND have reset/recovery/forgot in the name
-         */
-        const isRecoveryRelated = (text) => {
-            const lowerText = text.toLowerCase();
-            // Require BOTH a password keyword AND a recovery action keyword
-            const passwordKeywords = ['password', 'pwd'];
-            const recoveryKeywords = ['reset', 'recover', 'forgot', 'restore'];
-            const hasPasswordKeyword = passwordKeywords.some(keyword => lowerText.includes(keyword));
-            const hasRecoveryKeyword = recoveryKeywords.some(keyword => lowerText.includes(keyword));
-            // Both must be present to be considered recovery-related
-            if (hasPasswordKeyword && hasRecoveryKeyword) {
-                return true;
-            }
-            // Also check for compound patterns that strongly indicate password recovery
-            const strongRecoveryPatterns = [
-                'resetpassword', 'passwordreset', 'forgotpassword', 'passwordrecovery',
-                'recoverytoken', 'password_reset', 'forgot_password', 'reset_password',
-                'passwordforgot', 'recoverpassword'
-            ];
-            return strongRecoveryPatterns.some(pattern => lowerText.includes(pattern));
-        };
-        /**
-         * Check if token generation is cryptographically secure
-         */
-        const isSecureTokenGeneration = (callExpression) => {
-            const callText = sourceCode.getText(callExpression);
-            return secureTokenFunctions.some(func => callText.includes(func));
-        };
-        /**
-         * Check if token has expiration
-         */
-        const hasTokenExpiration = (functionNode) => {
-            const functionText = sourceCode.getText(functionNode).toLowerCase();
-            return functionText.includes('expire') ||
-                functionText.includes('ttl') ||
-                functionText.includes('timeout') ||
-                functionText.includes('lifetime');
-        };
-        return {
-            // Check variable declarations for recovery tokens
-            VariableDeclarator(node) {
-                if (!node.init || node.id.type !== 'Identifier') {
-                    return;
-                }
-                const varName = node.id.name.toLowerCase();
-                // Check if variable is specifically password-recovery-related (not just any token)
-                if (isRecoveryRelated(varName)) {
-                    const initText = sourceCode.getText(node.init);
-                    // Check for weak token generation
-                    if (node.init.type === 'CallExpression') {
-                        if (!isSecureTokenGeneration(node.init)) {
-                            // FALSE POSITIVE REDUCTION
-                            if (safetyChecker.isSafe(node, context) || (node.parent && safetyChecker.isSafe(node.parent, context))) {
-                                return;
-                            }
-                            context.report({
-                                node: node.init,
-                                messageId: 'predictableRecoveryToken',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                    else if (node.init.type === 'BinaryExpression') {
-                        // Check for predictable patterns
-                        const weakPatterns = ['Date.now()', 'Math.random()', 'timestamp', 'new Date()'];
-                        if (weakPatterns.some(pattern => initText.includes(pattern))) {
-                            // FALSE POSITIVE REDUCTION
-                            if (safetyChecker.isSafe(node, context) || (node.parent && safetyChecker.isSafe(node.parent, context))) {
-                                return;
-                            }
-                            context.report({
-                                node: node.init,
-                                messageId: 'insufficientTokenEntropy',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                }
-            },
-            // Check function declarations for recovery logic
-            // ONLY check function NAME to avoid FPs on any function that mentions "password"
-            FunctionDeclaration(node) {
-                if (!node.id) {
-                    return;
-                }
-                const functionName = node.id.name;
-                const functionText = sourceCode.getText(node).toLowerCase();
-                // IMPORTANT: Only check the function NAME, not the entire body
-                // This prevents flagging every function that happens to contain "password"
-                if (isRecoveryRelated(functionName)) {
-                    // Check for token expiration
-                    if (!hasTokenExpiration(node)) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(node, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: node.id,
-                            messageId: 'missingTokenExpiration',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                    // Check for rate limiting (very basic check)
-                    if (!functionText.includes('limit') && !functionText.includes('rate')) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(node, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: node.id,
-                            messageId: 'missingRateLimit',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                }
-            },
-            // Check call expressions for logging sensitive data
-            CallExpression(node) {
-                const callee = node.callee;
-                // Check for console.log, logger calls
-                if ((callee.type === 'MemberExpression' &&
-                    callee.object.type === 'Identifier' &&
-                    (callee.object.name === 'console' || callee.object.name === 'logger') &&
-                    callee.property.type === 'Identifier' &&
-                    ['log', 'info', 'warn', 'error'].includes(callee.property.name)) ||
-                    (callee.type === 'Identifier' && callee.name === 'logger')) {
-                    const args = node.arguments;
-                    for (const arg of args) {
-                        // Ignore literal strings (labels, messages) - focusing on sensitive variables
-                        if (arg.type === 'Literal') {
-                            continue;
-                        }
-                        const argText = sourceCode.getText(arg).toLowerCase();
-                        // Check if logging recovery-related sensitive data
-                        if (isRecoveryRelated(argText) &&
-                            (argText.includes('token') || argText.includes('password') ||
-                                argText.includes('reset') || argText.includes('code'))) {
-                            // FALSE POSITIVE REDUCTION
-                            if (safetyChecker.isSafe(node, context)) {
-                                continue;
-                            }
-                            context.report({
-                                node: arg,
-                                messageId: 'recoveryLoggingSensitiveData',
-                                data: {
-                                    filePath: filename,
-                                    line: String(node.loc?.start.line ?? 0),
-                                },
-                            });
-                        }
-                    }
-                }
-            },
-            // Check for weak recovery verification
-            IfStatement(node) {
-                const test = node.test;
-                const testText = sourceCode.getText(test).toLowerCase();
-                // Check if this is a recovery-related condition
-                if (isRecoveryRelated(testText)) {
-                    // Look for weak verification (just checking email exists)
-                    if (testText.includes('email') && !testText.includes('verify') &&
-                        !testText.includes('token') && !testText.includes('code') &&
-                        !testText.includes('otp') && !testText.includes('sms')) {
-                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
-                        if (safetyChecker.isSafe(node, context)) {
-                            return;
-                        }
-                        /* c8 ignore stop */
-                        context.report({
-                            node: test,
-                            messageId: 'weakRecoveryVerification',
-                            data: {
-                                filePath: filename,
-                                line: String(node.loc?.start.line ?? 0),
-                            },
-                        });
-                    }
-                }
-            }
-        };
-    },
-});

package/src/rules/no-xpath-injection/index.d.ts

@@ -1,10 +0,0 @@
-import { type SecurityRuleOptions } from '@interlace/eslint-devkit';
-export interface Options extends SecurityRuleOptions {
-    /** XPath-related function names to check */
-    xpathFunctions?: string[];
-    /** Functions that safely construct XPath queries */
-    safeXpathConstructors?: string[];
-    /** Functions that validate/sanitize XPath input */
-    xpathValidationFunctions?: string[];
-}
-export declare const noXpathInjection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;