eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/require-url-validation/index.js

@@ -1,72 +0,0 @@
-"use strict";
-/**
- * @fileoverview Enforce URL validation before navigation
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireUrlValidation = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.requireUrlValidation = (0, eslint_devkit_1.createRule)({
-    name: 'require-url-validation',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Enforce URL validation before navigation',
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'URL Validation Required',
-                cwe: 'CWE-601',
-                description: 'Unvalidated URL used for navigation - this is a security risk',
-                severity: 'HIGH',
-                fix: 'Validate URLs before using them for navigation',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/601.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        function report(node) {
-            context.report({ node, messageId: 'violationDetected' });
-        }
-        return {
-            AssignmentExpression(node) {
-                // Detect window.location assignment from user input
-                if (node.left.type === 'MemberExpression' &&
-                    node.left.object.type === 'Identifier' &&
-                    node.left.object.name === 'window' &&
-                    node.left.property.type === 'Identifier' &&
-                    node.left.property.name === 'location') {
-                    // Flag if right side is a variable (not a literal URL)
-                    if (node.right.type === 'Identifier') {
-                        report(node);
-                    }
-                }
-                // Detect location.href assignment
-                if (node.left.type === 'MemberExpression' &&
-                    node.left.object.type === 'Identifier' &&
-                    node.left.object.name === 'location' &&
-                    node.left.property.type === 'Identifier' &&
-                    node.left.property.name === 'href') {
-                    if (node.right.type === 'Identifier') {
-                        report(node);
-                    }
-                }
-            },
-            CallExpression(node) {
-                // Detect window.open with variable URL
-                if (node.callee.type === 'MemberExpression' &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'window' &&
-                    node.callee.property.type === 'Identifier' &&
-                    node.callee.property.name === 'open') {
-                    const urlArg = node.arguments[0];
-                    if (urlArg && urlArg.type === 'Identifier') {
-                        report(node);
-                    }
-                }
-            },
-        };
-    },
-});

package/src/types/index.js

@@ -1,17 +0,0 @@
-"use strict";
-/**
- * eslint-plugin-secure-coding Type Exports
- *
- * Barrel file that exports all security rule Options types with consistent naming.
- *
- * Usage:
- * ```typescript
- * import type { NoSqlInjectionOptions } from 'eslint-plugin-secure-coding/types';
- *
- * const config: NoSqlInjectionOptions = {
- *   allowDynamicTableNames: false,
- *   strategy: 'parameterize',
- * };
- * ```
- */
-Object.defineProperty(exports, "__esModule", { value: true });