eslint-plugin-secure-coding 2.3.2 → 2.3.3

package/src/rules/detect-non-literal-regexp/index.js

@@ -1,403 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectNonLiteralRegexp = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const eslint_devkit_2 = require("@interlace/eslint-devkit");
-// Type guard for regex literal nodes
-const isRegExpLiteral = (node) => {
-    return node.type === 'Literal' && Object.prototype.hasOwnProperty.call(node, 'regex');
-};
-const REGEXP_PATTERNS = [
-    {
-        pattern: 'new RegExp\\(.*\\)',
-        dangerous: true,
-        vulnerability: 'redos',
-        safeAlternative: 'Pre-defined RegExp constants',
-        example: {
-            bad: 'new RegExp(userInput)',
-            good: 'const PATTERNS = { email: /^[a-zA-Z0-9]+$/ }; PATTERNS[userChoice]'
-        },
-        effort: '10-15 minutes',
-        riskLevel: 'high'
-    },
-    {
-        pattern: 'RegExp\\(.*\\)',
-        dangerous: true,
-        vulnerability: 'redos',
-        safeAlternative: 'Static RegExp literals or validated patterns',
-        example: {
-            bad: 'RegExp(userPattern)',
-            good: 'const safePattern = userPattern.replace(/[.*+?^${}()|[\\]\\\\]/g, \'\\\\$&\'); new RegExp(`^${safePattern}$`)'
-        },
-        effort: '15-20 minutes',
-        riskLevel: 'high'
-    },
-    {
-        pattern: '/.*\\*\\*.*|.*\\+\\+.*|.*\\?\\?/',
-        dangerous: true,
-        vulnerability: 'redos',
-        safeAlternative: 'Avoid nested quantifiers, use atomic groups',
-        example: {
-            bad: '/(a+)+b/', // ReDoS vulnerable
-            good: '/(?>a+)b/', // Atomic group (if supported) or restructure
-        },
-        effort: '20-30 minutes',
-        riskLevel: 'critical'
-    }
-];
-exports.detectNonLiteralRegexp = (0, eslint_devkit_2.createRule)({
-    name: 'detect-non-literal-regexp',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression',
-        },
-        messages: {
-            // 🎯 Token optimization: 41% reduction (51→30 tokens) - compact template variables
-            regexpReDoS: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.WARNING,
-                issueName: 'ReDoS vulnerability',
-                cwe: 'CWE-400',
-                description: 'ReDoS vulnerability detected',
-                severity: '{{riskLevel}}',
-                fix: '{{safeAlternative}}',
-                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
-            }),
-            useStaticRegex: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Static Regex',
-                description: 'Use pre-defined RegExp constants',
-                severity: 'LOW',
-                fix: 'const PATTERN = /^[a-z]+$/; // Define at module level',
-                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp',
-            }),
-            validateInput: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Validate Input',
-                description: 'Validate and escape user input',
-                severity: 'LOW',
-                fix: 'Validate input length and characters before RegExp',
-                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
-            }),
-            useRegexLibrary: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Use Safe Library',
-                description: 'Use safe-regex library or re2',
-                severity: 'LOW',
-                fix: 'import { isSafe } from "safe-regex"; if (isSafe(pattern)) ...',
-                documentationLink: 'https://github.com/substack/safe-regex',
-            }),
-            addTimeout: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Add Timeout',
-                description: 'Add timeout to regex operations',
-                severity: 'LOW',
-                fix: 'Use timeout wrapper for regex operations',
-                documentationLink: 'https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS',
-            }),
-            escapeUserInput: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Escape Input',
-                description: 'Escape special regex characters',
-                severity: 'LOW',
-                fix: 'input.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")',
-                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping',
-            })
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    allowLiterals: {
-                        type: 'boolean',
-                        default: false,
-                        description: 'Allow literal string regex patterns'
-                    },
-                    additionalPatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Additional RegExp creation patterns to check'
-                    },
-                    maxPatternLength: {
-                        type: 'number',
-                        default: 100,
-                        minimum: 1,
-                        description: 'Maximum allowed pattern length for dynamic regex'
-                    }
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            allowLiterals: false,
-            additionalPatterns: [],
-            maxPatternLength: 100
-        },
-    ],
-    create(context) {
-        const options = context.options[0] || {};
-        const { allowLiterals = false, maxPatternLength = 100 } = options || {};
-        /**
-         * Check if a node is a literal string (potentially safe)
-         * Includes template literals without expressions
-         */
-        const isLiteralString = (node) => {
-            if (node.type === 'Literal' && typeof node.value === 'string') {
-                return true;
-            }
-            // Template literals without expressions are also static/safe
-            if (node.type === 'TemplateLiteral' && node.expressions.length === 0) {
-                return true;
-            }
-            return false;
-        };
-        /**
-         * Check if a regex pattern contains dangerous ReDoS patterns
-         * Only flag truly dangerous patterns like nested quantifiers: (a+)+, (a*)*
-         */
-        const hasReDoSPatterns = (pattern) => {
-            // Detect truly dangerous nested quantifier patterns that cause exponential backtracking
-            // Pattern like (a+)+, (a*)+, (a+)*, (a*)*, ([a-z]+)+
-            const nestedQuantifierPatterns = [
-                /\([^)]*[+*]\)[+*]/, // (something+)+ or (something*)* patterns
-                /\([^)]*[+*]\)\{[0-9,]+\}/, // (something+){n,m} patterns
-            ];
-            for (const dangerousPattern of nestedQuantifierPatterns) {
-                if (dangerousPattern.test(pattern)) {
-                    return true;
-                }
-            }
-            return false;
-        };
-        /**
-         * Extract regex pattern from RegExp construction
-         */
-        const extractPattern = (node) => {
-            const sourceCode = context.sourceCode || context.sourceCode;
-            // Determine constructor type
-            let constructor = 'RegExp';
-            if (node.type === 'NewExpression' && node.callee.type === 'Identifier') {
-                constructor = `new ${node.callee.name}`;
-            }
-            // First argument is the pattern
-            const patternNode = node.arguments.length > 0 ? node.arguments[0] : null;
-            const pattern = patternNode ? sourceCode.getText(patternNode) : '';
-            const isDynamic = patternNode ? !isLiteralString(patternNode) : false;
-            const length = patternNode && isLiteralString(patternNode) ?
-                String(patternNode.value).length : pattern.length;
-            return { pattern, patternNode, constructor, isDynamic, length };
-        };
-        /**
-         * Detect the specific vulnerability pattern
-         */
-        const detectVulnerability = (pattern, isDynamic) => {
-            // Check for dynamic construction first (highest risk)
-            if (isDynamic) {
-                for (const vuln of REGEXP_PATTERNS) {
-                    if (new RegExp(vuln.pattern, 'i').test(pattern)) {
-                        return vuln;
-                    }
-                }
-                // Generic dynamic RegExp construction
-                return {
-                    pattern: 'dynamic',
-                    dangerous: true,
-                    vulnerability: 'redos',
-                    safeAlternative: 'Pre-defined RegExp constants',
-                    example: {
-                        bad: pattern,
-                        good: 'const PATTERNS = { email: /^[a-zA-Z0-9]+$/ }; PATTERNS[type]'
-                    },
-                    effort: '10-15 minutes',
-                    riskLevel: 'high'
-                };
-            }
-            // Check for ReDoS patterns in literal regex
-            if (hasReDoSPatterns(pattern)) {
-                return {
-                    pattern: 'redos-literal',
-                    dangerous: true,
-                    vulnerability: 'redos',
-                    safeAlternative: 'Restructure regex to avoid nested quantifiers',
-                    example: {
-                        bad: pattern,
-                        good: pattern.replace(/(a+)\+/g, '$1') // Simplified example
-                    },
-                    effort: '20-30 minutes',
-                    riskLevel: 'high'
-                };
-            }
-            return null;
-        };
-        /**
-         * Generate refactoring steps based on the vulnerability
-         */
-        const generateRefactoringSteps = (vulnerability) => {
-            if (vulnerability.pattern === 'dynamic') {
-                return [
-                    '   1. Create a whitelist of allowed regex patterns',
-                    '   2. Use object lookup: PATTERNS[userChoice]',
-                    '   3. If dynamic needed: escape input with regex escaping function',
-                    '   4. Add pattern length validation',
-                    '   5. Consider using a safe regex library'
-                ].join('\n');
-            }
-            if (vulnerability.pattern === 'redos-literal') {
-                return [
-                    '   1. Identify nested quantifiers (*+, ++, ?+)',
-                    '   2. Restructure regex to avoid exponential backtracking',
-                    '   3. Use atomic groups if supported: (?>...)',
-                    '   4. Test regex performance with long inputs',
-                    '   5. Consider alternatives like string methods'
-                ].join('\n');
-            }
-            switch (vulnerability.vulnerability) {
-                case 'redos':
-                    return [
-                        '   1. Avoid nested quantifiers and backreferences',
-                        '   2. Use possessive quantifiers: *+, ++, ?+',
-                        '   3. Restructure regex to be more specific',
-                        '   4. Test with potentially malicious inputs',
-                        '   5. Consider safe-regex library validation'
-                    ].join('\n');
-                case 'injection':
-                    return [
-                        '   1. Escape user input before RegExp construction',
-                        '   2. Use RegExp.escape() if available',
-                        '   3. Validate input against allowed character sets',
-                        '   4. Add length limits to prevent oversized patterns',
-                        '   5. Use static patterns when possible'
-                    ].join('\n');
-                default:
-                    return [
-                        '   1. Identify the specific regex use case',
-                        '   2. Choose appropriate safe alternative',
-                        '   3. Add input validation and escaping',
-                        '   4. Test thoroughly with edge cases',
-                        '   5. Monitor performance in production'
-                    ].join('\n');
-            }
-        };
-        /**
-         * Determine overall risk level
-         */
-        const determineRiskLevel = (vulnerability, pattern) => {
-            if (vulnerability.riskLevel === 'critical' || hasReDoSPatterns(pattern)) {
-                return 'CRITICAL';
-            }
-            if (vulnerability.riskLevel === 'high') {
-                return 'HIGH';
-            }
-            return 'MEDIUM';
-        };
-        /**
-         * Check RegExp constructor calls for vulnerabilities
-         */
-        const checkRegExpCall = (node) => {
-            // Check for RegExp constructor calls
-            const isRegExpCall = node.callee.type === 'Identifier' && node.callee.name === 'RegExp';
-            const isNewRegExp = node.type === 'NewExpression' && node.callee.type === 'Identifier' && node.callee.name === 'RegExp';
-            if (!isRegExpCall && !isNewRegExp) {
-                return;
-            }
-            const { pattern, patternNode, isDynamic, length } = extractPattern(node);
-            // Allow literals if configured and pattern is reasonable length
-            if (allowLiterals && patternNode && isLiteralString(patternNode) && length <= maxPatternLength) {
-                // Still check for ReDoS patterns even in literals
-                if (!hasReDoSPatterns(pattern)) {
-                    return;
-                }
-            }
-            const vulnerability = detectVulnerability(pattern, isDynamic);
-            // If no specific vulnerability detected but it's dynamic, still warn
-            const effectiveVulnerability = vulnerability || (isDynamic ? {
-                pattern: 'dynamic',
-                dangerous: true,
-                vulnerability: 'redos',
-                safeAlternative: 'Use static RegExp patterns',
-                example: {
-                    bad: pattern,
-                    good: '/^safe-pattern$/'
-                },
-                effort: '10-15 minutes',
-                riskLevel: 'medium'
-            } : null);
-            if (!effectiveVulnerability) {
-                return;
-            }
-            const riskLevel = determineRiskLevel(effectiveVulnerability, pattern);
-            const steps = generateRefactoringSteps(effectiveVulnerability);
-            context.report({
-                node,
-                messageId: 'regexpReDoS',
-                data: {
-                    pattern: pattern.substring(0, 30) + (pattern.length > 30 ? '...' : ''),
-                    riskLevel,
-                    vulnerability: effectiveVulnerability.vulnerability,
-                    safeAlternative: effectiveVulnerability.safeAlternative,
-                    steps,
-                    effort: effectiveVulnerability.effort
-                },
-                suggest: [
-                    {
-                        messageId: 'useStaticRegex',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'validateInput',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'useRegexLibrary',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'addTimeout',
-                        fix: () => null
-                    },
-                    {
-                        messageId: 'escapeUserInput',
-                        fix: () => null
-                    }
-                ]
-            });
-        };
-        /**
-         * Check literal regex patterns for ReDoS vulnerabilities
-         */
-        const checkLiteralRegExp = (node) => {
-            if (!isRegExpLiteral(node)) {
-                return;
-            }
-            const pattern = node.regex.pattern;
-            // Check for ReDoS patterns
-            if (hasReDoSPatterns(pattern)) {
-                const vulnerability = detectVulnerability(pattern, false);
-                if (vulnerability) {
-                    const riskLevel = determineRiskLevel(vulnerability, pattern);
-                    const steps = generateRefactoringSteps(vulnerability);
-                    context.report({
-                        node,
-                        messageId: 'regexpReDoS',
-                        data: {
-                            pattern: pattern.substring(0, 30) + (pattern.length > 30 ? '...' : ''),
-                            riskLevel,
-                            vulnerability: vulnerability.vulnerability,
-                            safeAlternative: vulnerability.safeAlternative,
-                            steps,
-                            effort: vulnerability.effort
-                        }
-                    });
-                }
-            }
-        };
-        return {
-            CallExpression: checkRegExpCall,
-            NewExpression: checkRegExpCall,
-            Literal: checkLiteralRegExp
-        };
-    },
-});

package/src/rules/detect-object-injection/index.d.ts

@@ -1,11 +0,0 @@
-export interface Options {
-    /** Allow bracket notation with literal strings. Default: false (stricter) */
-    allowLiterals?: boolean;
-    /** Additional object methods to check for injection */
-    additionalMethods?: string[];
-    /** Properties to consider dangerous. Default: __proto__, prototype, constructor */
-    dangerousProperties?: string[];
-    /** Strategy for fixing object injection: 'validate', 'whitelist', 'freeze', or 'auto' */
-    strategy?: 'validate' | 'whitelist' | 'freeze' | 'auto';
-}
-export declare const detectObjectInjection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;