eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/detect-eval-with-expression/index.js

@@ -1,392 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectEvalWithExpression = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-const EVAL_PATTERNS = [
-    {
-        pattern: 'JSON\\.parse|parse\\(.*\\)',
-        category: 'json',
-        safeAlternative: 'JSON.parse()',
-        example: {
-            bad: 'eval(\'{"key": "\' + value + \'"}"\')',
-            good: 'JSON.parse(\'{"key": "\' + value + \'"}"\')'
-        },
-        effort: '2 minutes'
-    },
-    {
-        pattern: 'Math\\.|parseInt|parseFloat',
-        category: 'math',
-        safeAlternative: 'Math functions or parseInt/parseFloat',
-        example: {
-            bad: 'eval(\'Math.\' + method + \'(\' + arg + \')\')',
-            good: 'const mathMethods = {sin: Math.sin, cos: Math.cos}; mathMethods[method](arg)'
-        },
-        effort: '5 minutes'
-    },
-    {
-        pattern: '\\$\\{|template|interpolat',
-        category: 'template',
-        safeAlternative: 'Template literals or template engine',
-        example: {
-            bad: 'eval(\'Hello \' + userName + \'!\')',
-            good: 'const template = `Hello ${userName}!`;'
-        },
-        effort: '3 minutes'
-    },
-    {
-        pattern: '\\[.*\\]|object\\[|obj\\.|\\.',
-        category: 'object',
-        safeAlternative: 'Direct property access or Map',
-        example: {
-            bad: 'eval(\'obj.\' + property)',
-            good: 'const allowedProps = {name: true, age: true}; if (allowedProps[property]) obj[property]'
-        },
-        effort: '8 minutes'
-    }
-];
-exports.detectEvalWithExpression = (0, eslint_devkit_2.createRule)({
-    name: 'detect-eval-with-expression',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Detects eval(variable) which can allow an attacker to run arbitrary code',
-        },
-        messages: {
-            // 🎯 Token optimization: 38% reduction (47→29 tokens) - compact format saves LLM processing
-            evalWithExpression: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() with dynamic code',
-                cwe: 'CWE-95',
-                description: 'eval() with dynamic code',
-                severity: 'CRITICAL',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useJsonParse: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for JSON parsing',
-                cwe: 'CWE-95',
-                description: 'Use JSON.parse() instead of eval() for JSON string parsing',
-                severity: 'HIGH',
-                fix: 'Replace eval() with JSON.parse()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useObjectAccess: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for property access',
-                cwe: 'CWE-95',
-                description: 'Use direct property access instead of eval() for dynamic property access',
-                severity: 'HIGH',
-                fix: 'Use obj[key] or Map.get(key) instead of eval()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useTemplateLiteral: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for string interpolation',
-                cwe: 'CWE-95',
-                description: 'Use template literals instead of eval() for string interpolation',
-                severity: 'HIGH',
-                fix: 'Replace eval() with template literals: `Hello ${name}`',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useFunctionConstructor: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() for function creation',
-                cwe: 'CWE-95',
-                description: 'Use Function constructor with validation instead of eval()',
-                severity: 'HIGH',
-                fix: 'Replace eval() with validated Function constructor',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            useSaferAlternative: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Unsafe eval() usage detected',
-                cwe: 'CWE-95',
-                description: 'eval() with dynamic code execution detected',
-                severity: 'HIGH',
-                fix: '{{alternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyRemove: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Critical eval() security vulnerability',
-                cwe: 'CWE-95',
-                description: 'eval() usage poses severe security risk',
-                severity: 'CRITICAL',
-                fix: 'Remove eval() entirely - security risk too high',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyRefactor: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() refactoring required',
-                cwe: 'CWE-95',
-                description: 'eval() can be refactored to safer alternative',
-                severity: 'HIGH',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            }),
-            strategyValidate: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'eval() input validation needed',
-                cwe: 'CWE-95',
-                description: 'eval() requires input validation for security',
-                severity: 'MEDIUM',
-                fix: 'Add input validation before using eval()',
-                documentationLink: 'https://owasp.org/www-community/attacks/Code_Injection',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowLiteralStrings: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow eval with literal strings (false = stricter)'
-                    },
-                    additionalEvalFunctions: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional functions to treat as eval-like'
-                    },
-                    strategy: {
-                        type: 'string',
-                        enum: ['remove', 'refactor', 'validate', 'auto'],
-                        default: 'auto',
-                        description: 'Strategy for fixing eval usage (auto = smart detection)'
-                    }
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowLiteralStrings: false,
-            additionalEvalFunctions: [],
-            strategy: 'auto'
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { allowLiteralStrings = false, additionalEvalFunctions = [], strategy = 'auto' } = options || {};
-        /**
-         * All functions that can execute arbitrary code
-         * NOTE: setTimeout/setInterval are NOT eval-like - they don't execute code strings
-         */
-        const evalFunctions = [
-            'eval',
-            'Function',
-            ...additionalEvalFunctions
-        ];
-        /**
-         * Check if a node is a literal string (safe)
-         */
-        const isLiteralString = (node) => {
-            return node.type === 'Literal' && typeof node.value === 'string';
-        };
-        /**
-         * Select message ID based on strategy
-         */
-        const selectStrategyMessage = (pattern) => {
-            switch (strategy) {
-                case 'remove':
-                    return 'strategyRemove';
-                case 'refactor':
-                    return 'strategyRefactor';
-                case 'validate':
-                    return 'strategyValidate';
-                case 'auto':
-                default:
-                    // Auto mode: choose based on pattern confidence
-                    if (pattern && pattern.category === 'json') {
-                        return 'useJsonParse';
-                    }
-                    if (pattern && pattern.category === 'object') {
-                        return 'useObjectAccess';
-                    }
-                    if (pattern && pattern.category === 'template') {
-                        return 'useTemplateLiteral';
-                    }
-                    return 'strategyRefactor'; // Default to refactor for unknown patterns
-            }
-        };
-        /**
-         * Detect the pattern category from the expression
-         */
-        const detectPattern = (expression) => {
-            for (const pattern of EVAL_PATTERNS) {
-                if (new RegExp(pattern.pattern, 'i').test(expression)) {
-                    return pattern;
-                }
-            }
-            return null;
-        };
-        /**
-         * Generate refactoring steps based on pattern
-         */
-        const generateRefactoringSteps = (pattern) => {
-            if (!pattern) {
-                return [
-                    '   1. Remove eval() usage entirely',
-                    '   2. Identify what the code is trying to achieve',
-                    '   3. Use appropriate safe alternative (JSON.parse, Map, etc.)',
-                    '   4. Add input validation if dynamic behavior needed',
-                    '   5. Test thoroughly for edge cases'
-                ].join('\n');
-            }
-            switch (pattern.category) {
-                case 'json':
-                    return [
-                        '   1. Replace eval() with JSON.parse()',
-                        '   2. Ensure input is valid JSON string',
-                        '   3. Add try/catch for JSON parsing errors',
-                        '   4. Consider using a JSON schema validator'
-                    ].join('\n');
-                case 'math':
-                    return [
-                        '   1. Create whitelist of allowed Math functions',
-                        '   2. Use direct function calls: Math.sin(x)',
-                        '   3. Validate inputs are numbers',
-                        '   4. Consider using a math expression parser library'
-                    ].join('\n');
-                case 'template':
-                    return [
-                        '   1. Use template literals: `Hello ${name}`',
-                        '   2. Sanitize variables before interpolation',
-                        '   3. Use a template engine like Handlebars if complex',
-                        '   4. Validate template structure'
-                    ].join('\n');
-                case 'object':
-                    return [
-                        '   1. Use Map or plain object for key-value access',
-                        '   2. Whitelist allowed property names',
-                        '   3. Use hasOwnProperty() check',
-                        '   4. Consider Object.create(null) for clean objects'
-                    ].join('\n');
-                default:
-                    return [
-                        '   1. Identify the specific use case',
-                        '   2. Find a safer alternative approach',
-                        '   3. Add comprehensive input validation',
-                        '   4. Use static analysis if possible'
-                    ].join('\n');
-            }
-        };
-        /**
-         * Extract expression text for pattern analysis
-         */
-        const extractExpression = (node) => {
-            const sourceCode = context.sourceCode || context.sourceCode;
-            // Try to get the argument text
-            if (node.arguments.length > 0) {
-                return sourceCode.getText(node.arguments[0]);
-            }
-            return 'dynamic expression';
-        };
-        /**
-         * Check call expressions for dangerous eval usage
-         */
-        const checkCallExpression = (node) => {
-            // Check if it's a call to an eval-like function
-            if (node.callee.type === 'Identifier' &&
-                evalFunctions.includes(node.callee.name)) {
-                // Skip if it's a literal string and literals are allowed
-                if (allowLiteralStrings &&
-                    node.arguments.length > 0 &&
-                    isLiteralString(node.arguments[0])) {
-                    return;
-                }
-                // Skip if it's a direct string literal (safe)
-                if (node.arguments.length > 0 &&
-                    node.callee.name === 'eval' &&
-                    isLiteralString(node.arguments[0])) {
-                    return;
-                }
-                const expression = extractExpression(node);
-                const pattern = detectPattern(expression);
-                const steps = generateRefactoringSteps(pattern);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression,
-                        patternCategory: pattern?.category || 'dynamic code execution',
-                        safeAlternative: pattern?.safeAlternative || 'Remove eval entirely',
-                        steps,
-                        effort: pattern?.effort || '15-30 minutes'
-                    },
-                    suggest: pattern ? [
-                        {
-                            messageId: strategyMessageId,
-                            data: {
-                                safeAlternative: pattern.safeAlternative,
-                                alternative: pattern.safeAlternative
-                            },
-                            fix: () => null // Complex refactoring, cannot auto-fix safely
-                        }
-                    ] : undefined
-                });
-            }
-            // Also check for Function constructor usage
-            if (node.callee.type === 'NewExpression' &&
-                node.callee.callee.type === 'Identifier' &&
-                node.callee.callee.name === 'Function') {
-                const expression = extractExpression(node);
-                const pattern = detectPattern(expression);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression: `new Function(${expression})`,
-                        patternCategory: 'function constructor',
-                        safeAlternative: 'Arrow function or regular function',
-                        steps: [
-                            '   1. Replace Function constructor with arrow function',
-                            '   2. Use regular function declaration',
-                            '   3. Validate any dynamic parts',
-                            '   4. Consider module imports instead'
-                        ].join('\n'),
-                        effort: '10 minutes'
-                    }
-                });
-            }
-        };
-        /**
-         * Check NewExpression for Function constructor usage
-         */
-        const checkNewExpression = (node) => {
-            // Check for new Function() usage
-            if (node.callee.type === 'Identifier' && node.callee.name === 'Function') {
-                const sourceCode = context.sourceCode || context.sourceCode;
-                const expression = node.arguments.map((arg) => sourceCode.getText(arg)).join(', ');
-                const pattern = detectPattern(expression);
-                const strategyMessageId = selectStrategyMessage(pattern);
-                context.report({
-                    node,
-                    messageId: strategyMessageId,
-                    data: {
-                        expression: `new Function(${expression})`,
-                        patternCategory: 'function constructor',
-                        safeAlternative: 'Arrow function or regular function',
-                        steps: [
-                            '   1. Replace Function constructor with arrow function',
-                            '   2. Use regular function declaration',
-                            '   3. Validate any dynamic parts',
-                            '   4. Consider module imports instead'
-                        ].join('\n'),
-                        effort: '10 minutes'
-                    }
-                });
-            }
-        };
-        return {
-            CallExpression: checkCallExpression,
-            NewExpression: checkNewExpression
-        };
-    },
-});

package/src/rules/detect-mixed-content/index.d.ts

@@ -1,8 +0,0 @@
-/**
- * @fileoverview Detect HTTP resources in HTTPS pages
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/311.html
- */
-export interface Options {
-}
-export declare const detectMixedContent: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;

package/src/rules/detect-mixed-content/index.js

@@ -1,44 +0,0 @@
-"use strict";
-/**
- * @fileoverview Detect HTTP resources in HTTPS pages
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/311.html
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectMixedContent = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.detectMixedContent = (0, eslint_devkit_1.createRule)({
-    name: 'detect-mixed-content',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Detect HTTP resources in HTTPS pages',
-            category: 'Security',
-            recommended: true,
-            owaspMobile: ['M5'],
-            cweIds: ["CWE-311"],
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'violation Detected',
-                cwe: 'CWE-311',
-                description: 'Detect HTTP resources in HTTPS pages detected - Literal containing http:// in HTTPS context',
-                severity: 'MEDIUM',
-                fix: 'Review and apply secure practices',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/311.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        return {
-            Literal(node) {
-                if (typeof node.value === 'string' && node.value.startsWith('http://')) {
-                    context.report({ node, messageId: 'violationDetected' });
-                }
-            },
-        };
-    },
-});

package/src/rules/detect-non-literal-fs-filename/index.d.ts

@@ -1,7 +0,0 @@
-export interface Options {
-    /** Allow literal strings. Default: false (stricter) */
-    allowLiterals?: boolean;
-    /** Additional fs methods to check */
-    additionalMethods?: string[];
-}
-export declare const detectNonLiteralFsFilename: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;