eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/no-document-cookie/no-document-cookie.test.ts

@@ -0,0 +1,382 @@
+/**
+ * Comprehensive tests for no-document-cookie rule
+ * Prevent direct usage of document.cookie
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { noDocumentCookie } from './index';
+
+// Configure RuleTester for Vitest
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+// Use Flat Config format (ESLint 9+)
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('no-document-cookie', () => {
+  describe('basic functionality', () => {
+    ruleTester.run('prevent document.cookie usage', noDocumentCookie, {
+      valid: [
+        // Other document properties
+        {
+          code: 'document.title = "New Title";',
+        },
+        {
+          code: 'const url = document.URL;',
+        },
+        {
+          code: 'document.body.appendChild(element);',
+        },
+        // Other objects with cookie property
+        {
+          code: 'response.cookie = "value";',
+        },
+        {
+          code: 'const cookie = req.cookies;',
+        },
+        // Cookie Store API usage (recommended)
+        {
+          code: 'await cookieStore.set("name", "value");',
+        },
+        {
+          code: 'const cookies = await cookieStore.getAll();',
+        },
+        // Cookie libraries
+        {
+          code: 'Cookies.set("name", "value");',
+        },
+        {
+          code: 'const value = Cookies.get("name");',
+        },
+        // Reading document.cookie (allowed by default)
+        {
+          code: 'const cookies = document.cookie;',
+        },
+        {
+          code: 'console.log(document.cookie);',
+        },
+        {
+          code: 'const parsed = document.cookie.split("; ");',
+        },
+      ],
+      invalid: [
+        // Direct assignment
+        {
+          code: 'document.cookie = "name=value";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Compound assignment
+        {
+          code: 'document.cookie += "; name=value";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('allowReading option', () => {
+    ruleTester.run('allowReading option', noDocumentCookie, {
+      valid: [
+        // Reading is allowed by default
+        {
+          code: 'const cookies = document.cookie;',
+          options: [{ allowReading: true }],
+        },
+        {
+          code: 'console.log(document.cookie);',
+          options: [{ allowReading: true }],
+        },
+        {
+          code: 'const parsed = document.cookie.split("; ");',
+          options: [{ allowReading: true }],
+        },
+      ],
+      invalid: [
+        // Assignments are still flagged
+        {
+          code: 'document.cookie = "name=value";',
+          options: [{ allowReading: true }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Reading is not allowed when disabled
+        {
+          code: 'const cookies = document.cookie;',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('complex expressions', () => {
+    ruleTester.run('complex expressions', noDocumentCookie, {
+      valid: [],
+      invalid: [
+        // In function calls
+        {
+          code: 'setCookie(document.cookie);',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In ternary expressions
+        {
+          code: 'const value = condition ? document.cookie : "default";',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In template literals
+        {
+          code: 'console.log(`Cookies: ${document.cookie}`);',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Chained method calls
+        {
+          code: 'document.cookie.split(";").forEach(cookie => console.log(cookie));',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Optional chaining
+        {
+          code: 'const cookies = document?.cookie;',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('different contexts', () => {
+    ruleTester.run('different code contexts', noDocumentCookie, {
+      valid: [],
+      invalid: [
+        // In function
+        {
+          code: `
+            function getCookies() {
+              return document.cookie;
+            }
+          `,
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In class method
+        {
+          code: `
+            class CookieManager {
+              getAll() {
+                document.cookie = "test=value";
+                return document.cookie;
+              }
+            }
+          `,
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In arrow function
+        {
+          code: 'const getCookie = () => document.cookie;',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In async function
+        {
+          code: `
+            async function setCookie(name, value) {
+              document.cookie = \`\${name}=\${value}\`;
+            }
+          `,
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // In conditional
+        {
+          code: `
+            if (typeof document !== 'undefined') {
+              document.cookie += "; path=/";
+            }
+          `,
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('edge cases', () => {
+    ruleTester.run('edge cases', noDocumentCookie, {
+      valid: [
+        // Shadowed document variable
+        {
+          code: `
+            const document = { cookie: "fake" };
+            console.log(document.cookie);
+          `,
+        },
+        // Different property names
+        {
+          code: 'document.cookies = "value";',
+        },
+        {
+          code: 'const value = document.cookieValue;',
+        },
+      ],
+      invalid: [
+        // Computed property access
+        {
+          code: 'document["cookie"] = "value";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Variable assignment
+        {
+          code: 'let cookie = document.cookie;',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Const assignment
+        {
+          code: 'const cookieString = document.cookie;',
+          options: [{ allowReading: false }],
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('assignment detection', () => {
+    ruleTester.run('assignment detection', noDocumentCookie, {
+      valid: [],
+      invalid: [
+        // Direct assignment
+        {
+          code: 'document.cookie = "session=abc123";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Assignment with path
+        {
+          code: 'document.cookie = "name=value; path=/";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Compound assignment
+        {
+          code: 'document.cookie += "; secure";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Assignment with expiration
+        {
+          code: 'document.cookie = "user=john; expires=Fri, 31 Dec 9999 23:59:59 GMT";',
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+        // Multiple assignments
+        {
+          code: `
+            document.cookie = "first=value1";
+            document.cookie = "second=value2";
+          `,
+          errors: [
+            {
+              messageId: 'noDocumentCookie',
+            },
+            {
+              messageId: 'noDocumentCookie',
+            },
+          ],
+        },
+      ],
+    });
+  });
+});

package/src/rules/no-dynamic-dependency-loading/index.ts

@@ -0,0 +1,60 @@
+/**
+ * @fileoverview Prevent dynamic dependency injection
+ * @see https://owasp.org/www-project-mobile-top-10/
+ * @see https://cwe.mitre.org/data/definitions/494.html
+ */
+
+import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
+import type { TSESTree } from '@interlace/eslint-devkit';
+
+type MessageIds = 'violationDetected';
+
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
+export interface Options {}
+
+type RuleOptions = [Options?];
+
+export const noDynamicDependencyLoading = createRule<RuleOptions, MessageIds>({
+  name: 'no-dynamic-dependency-loading',
+  meta: {
+    type: 'problem',
+    docs: {
+      description: 'Prevent runtime dependency injection with dynamic paths',
+      category: 'Security',
+      recommended: true,
+      owaspMobile: ['M2'],
+      cweIds: ['CWE-494'],
+    },
+    messages: {
+      violationDetected: formatLLMMessage({
+        icon: MessageIcons.SECURITY,
+        issueName: 'violation Detected',
+        cwe: 'CWE-1104',
+        description: 'Dynamic import/require detected - use static imports for security',
+        severity: 'HIGH',
+        fix: 'Review and apply secure practices',
+        documentationLink: 'https://cwe.mitre.org/data/definitions/1104.html',
+      })
+    },
+    schema: [],
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node: TSESTree.CallExpression) {
+        // Dynamic require
+        if (node.callee.name === 'require' && node.arguments[0]?.type !== 'Literal') {
+          context.report({ node, messageId: 'violationDetected' });
+        }
+      },
+      
+      ImportExpression(node: TSESTree.ImportExpression) {
+        // Dynamic import()
+        if (node.source.type !== 'Literal') {
+          context.report({ node, messageId: 'violationDetected' });
+        }
+      },
+   };
+  },
+});
+

package/src/rules/no-dynamic-dependency-loading/no-dynamic-dependency-loading.test.ts

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Tests for no-dynamic-dependency-loading
+ * 
+ * Coverage: Comprehensive test suite with valid and invalid cases
+ */
+
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { noDynamicDependencyLoading } from './index';
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+ruleTester.run('no-dynamic-dependency-loading', noDynamicDependencyLoading, {
+  valid: [
+    { code: "import module from './module'" },
+    { code: "const lib = require('known-lib')" }
+  ],
+
+  invalid: [
+    { code: "require(moduleName)", errors: [{ messageId: 'violationDetected' }] },
+    { code: "import(userInput)", errors: [{ messageId: 'violationDetected' }] }
+  ],
+});