eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/detect-eval-with-expression/detect-eval-with-expression.test.ts

@@ -0,0 +1,416 @@
+/**
+ * Comprehensive tests for detect-eval-with-expression rule  
+ * Security: CWE-95 (Code Injection)
+ */
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { describe, it, afterAll } from 'vitest';
+import parser from '@typescript-eslint/parser';
+import { detectEvalWithExpression } from './index';
+
+// Configure RuleTester for Vitest
+RuleTester.afterAll = afterAll;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+RuleTester.describe = describe;
+
+// Use Flat Config format (ESLint 9+)
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser,
+    ecmaVersion: 2022,
+    sourceType: 'module',
+  },
+});
+
+describe('detect-eval-with-expression', () => {
+  describe('Valid Code', () => {
+    ruleTester.run('valid - no eval calls', detectEvalWithExpression, {
+      valid: [
+        'const x = Math.eval();',
+        'const obj = { eval: () => {} }; obj.eval("code");',
+        'function myFunction(data) { return data; }',
+        'const result = calculateValue();',
+      ],
+      invalid: [],
+    });
+  });
+
+  describe('Dangerous eval() Calls', () => {
+    ruleTester.run('invalid - eval with expressions', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(userInput);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'eval(`code: ${value}`);',
+          errors: [{ messageId: 'useTemplateLiteral' }],
+        },
+        {
+          code: 'const result = eval(expression);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: `
+            function process(code) {
+              return eval(code);
+            }
+          `,
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('eval() in Different Contexts', () => {
+    ruleTester.run('invalid - eval in various contexts', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'const runner = (code) => eval(code);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: `
+            if (condition) {
+              eval(code);
+            }
+          `,
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: `
+            try {
+              eval(code);
+            } catch (e) {
+              console.error(e);
+            }
+          `,
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Multiple eval() Calls', () => {
+    ruleTester.run('invalid - multiple evals', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: `
+            eval(code1);
+            eval(code2);
+          `,
+          errors: [
+            { messageId: 'strategyRefactor' },
+            { messageId: 'strategyRefactor' },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('eval() with Complex Expressions', () => {
+    ruleTester.run('invalid - complex expressions', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(a || b);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: `
+            const code = getCode();
+            eval(code);
+          `,
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Edge Cases', () => {
+    ruleTester.run('edge cases', detectEvalWithExpression, {
+      valid: [
+        'const evalString = "eval(code)"; console.log(evalString);',
+      ],
+      invalid: [
+        {
+          code: '(eval)(code);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Pattern Detection - JSON (lines 187-195)', () => {
+    ruleTester.run('pattern detection - JSON', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval("JSON.parse(" + jsonString + ")");',
+          errors: [
+            {
+              messageId: 'useJsonParse',
+              // Note: Rule provides suggestions but fix returns null (no auto-fix)
+              // Test framework requires output for suggestions, so we don't test them here
+            },
+          ],
+        },
+      ],
+    });
+  });
+
+  describe('Pattern Detection - Object (lines 211-219)', () => {
+    ruleTester.run('pattern detection - object', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval("obj[" + key + "]");',
+          errors: [
+            {
+              messageId: 'useObjectAccess',
+              // Note: Rule provides suggestions but fix returns null (no auto-fix)
+            },
+          ],
+        },
+        {
+          code: 'eval("object[" + key + "]");',
+          errors: [{ messageId: 'useObjectAccess' }],
+        },
+        {
+          code: 'eval("obj." + property);',
+          errors: [{ messageId: 'useObjectAccess' }],
+        },
+      ],
+    });
+  });
+
+  describe('Uncovered Lines', () => {
+    // Line 219: Default case in generateRefactoringSteps
+    // This is triggered when the pattern doesn't match 'json', 'math', 'object', or 'template'
+    ruleTester.run('line 219 - default case in generateRefactoringSteps', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval("someOtherPattern" + value);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'eval("customPattern" + data);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+
+    // Note: Line 327 default case is not reachable with current pattern definitions
+    // All patterns have known categories ('json', 'math', 'template', 'object')
+  });
+
+  describe('Pattern Detection - Math (lines 194-200)', () => {
+    ruleTester.run('pattern detection - math', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(\'Math.sin(\' + angle + \')\');',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'eval("parseInt(" + value + ")");',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'eval("parseFloat(" + num + ")");',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Pattern Detection - Template (lines 202-208)', () => {
+    ruleTester.run('pattern detection - template', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval("${" + name + "}");',
+          errors: [
+            {
+              messageId: 'useTemplateLiteral',
+              // Note: Rule provides suggestions but fix returns null (no auto-fix)
+            },
+          ],
+        },
+        {
+          code: 'eval("template " + variable);',
+          errors: [{ messageId: 'useTemplateLiteral' }],
+        },
+        {
+          code: 'eval("interpolat" + value);',
+          errors: [{ messageId: 'useTemplateLiteral' }],
+        },
+      ],
+    });
+  });
+
+  describe('Options - allowLiteralStrings (line 254)', () => {
+    ruleTester.run('allowLiteralStrings option', detectEvalWithExpression, {
+      valid: [
+        {
+          code: 'eval("literal string");',
+          options: [{ allowLiteralStrings: true }],
+        },
+        {
+          code: 'eval(\'another literal\');',
+          options: [{ allowLiteralStrings: true }],
+        },
+      ],
+      invalid: [
+        {
+          code: 'eval(userInput);',
+          options: [{ allowLiteralStrings: true }],
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Options - strategy (lines 246-250)', () => {
+    ruleTester.run('strategy remove option', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(userInput);',
+          options: [{ strategy: 'remove' }],
+          errors: [{ messageId: 'strategyRemove' }],
+        },
+      ],
+    });
+
+    ruleTester.run('strategy refactor option', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(userInput);',
+          options: [{ strategy: 'refactor' }],
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+
+    ruleTester.run('strategy validate option', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval(userInput);',
+          options: [{ strategy: 'validate' }],
+          errors: [{ messageId: 'strategyValidate' }],
+        },
+      ],
+    });
+  });
+
+  describe('Edge Cases - Literal String (line 261)', () => {
+    ruleTester.run('edge cases - literal string eval', detectEvalWithExpression, {
+      valid: [
+        // eval with literal string is allowed by default (line 261)
+        'eval("literal string");',
+        "eval('literal string');",
+      ],
+      invalid: [
+        {
+          code: 'eval(variable);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Edge Cases - No Arguments (line 239)', () => {
+    ruleTester.run('edge cases - no arguments', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'eval();',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Function Constructor - CallExpression (lines 298-300)', () => {
+    ruleTester.run('function constructor in call expression', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        // Lines 298-300: Function constructor detection in CallExpression context
+        // This covers the case where Function is called as a function, not as a constructor
+        {
+          code: 'Function(code);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'Function("arg1", "arg2", "return arg1 + arg2");',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        // Lines 401-403: Edge case where new Function is called as a function
+        // This triggers both CallExpression and NewExpression checks
+        {
+          code: '(new Function)(code);',
+          errors: [
+            { messageId: 'strategyRefactor' }, // CallExpression check
+            { messageId: 'strategyRefactor' }  // NewExpression check
+          ],
+        },
+        {
+          code: '(new Function)("arg1", "return arg1 * 2");',
+          errors: [
+            { messageId: 'strategyRefactor' }, // CallExpression check
+            { messageId: 'strategyRefactor' }  // NewExpression check
+          ],
+        },
+        {
+          code: 'new Function(code);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'new Function("arg1", "arg2", "return arg1 + arg2");',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Function Constructor - NewExpression (lines 324-328)', () => {
+    ruleTester.run('function constructor in new expression', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'const fn = new Function(userCode);',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'const fn = new Function("x", "y", "return x + y");',
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+
+  describe('Additional Eval Functions', () => {
+    ruleTester.run('additional eval functions option', detectEvalWithExpression, {
+      valid: [],
+      invalid: [
+        {
+          code: 'customEval(userCode);',
+          options: [{ additionalEvalFunctions: ['customEval'] }],
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+        {
+          code: 'myEval(code);',
+          options: [{ additionalEvalFunctions: ['myEval', 'anotherEval'] }],
+          errors: [{ messageId: 'strategyRefactor' }],
+        },
+      ],
+    });
+  });
+});