eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-unvalidated-user-input/no-unvalidated-user-input.test.ts

@@ -1,463 +0,0 @@
-/**
- * Comprehensive tests for no-unvalidated-user-input rule
- * CWE-20: Improper Input Validation
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noUnvalidatedUserInput } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-// Use Flat Config format (ESLint 9+)
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-    parserOptions: {
-      ecmaFeatures: {
-        jsx: true,
-      },
-    },
-  },
-});
-
-describe('no-unvalidated-user-input', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - validated input', noUnvalidatedUserInput, {
-      valid: [
-        // Validated with Zod
-        {
-          code: `
-            const schema = z.object({ name: z.string() });
-            const data = schema.parse(req.body);
-          `,
-        },
-        {
-          code: `
-            const querySchema = z.object({ id: z.string() });
-            const query = querySchema.parse(req.query);
-          `,
-        },
-        // Validated with Joi
-        {
-          code: `
-            const schema = Joi.object({ name: Joi.string() });
-            const { value } = schema.validate(req.body);
-          `,
-        },
-        // Validated with class-validator
-        {
-          code: `
-            class Dto {
-              @IsString()
-              name: string;
-            }
-            const dto = plainToClass(Dto, req.body);
-            validate(dto);
-          `,
-        },
-        // Environment variables (not user input)
-        {
-          code: 'const apiKey = process.env.API_KEY;',
-        },
-        // Test files (when allowInTests is true)
-        {
-          code: 'const body = req.body;',
-          filename: 'test.spec.ts',
-          options: [{ allowInTests: true }],
-        },
-        // Ignored patterns
-        {
-          code: 'const safeInput = req.body;',
-          options: [{ ignorePatterns: ['safeInput'] }],
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Express Patterns', () => {
-    ruleTester.run('invalid - Express req.body', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const userData = req.body;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-              // Note: Suggestions are provided by the rule but not recognized by test framework
-              // because fix returns null (suggestions are not auto-fixable)
-            },
-          ],
-        },
-        {
-          code: 'function handler(req, res) { const data = req.body.name; }',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-        {
-          code: 'app.post("/api", (req, res) => { const { email } = req.body; });',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - Express req.query', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const id = req.query.id;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-        {
-          code: 'const { page, limit } = req.query;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - Express req.params', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const userId = req.params.id;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - Express req.headers', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const token = req.headers.authorization;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - Express req.cookies', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const sessionId = req.cookies.sessionId;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Fastify Patterns', () => {
-    ruleTester.run('invalid - Fastify request.body', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const data = request.body;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - Fastify request.query', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const query = request.query;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Next.js Patterns', () => {
-    ruleTester.run('invalid - Next.js searchParams', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const params = searchParams.get("id");',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Options', () => {
-    ruleTester.run('options - allowInTests', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const body = req.body;',
-          filename: 'handler.test.ts',
-          options: [{ allowInTests: true }],
-        },
-        {
-          code: 'const query = req.query;',
-          filename: '__tests__/api.spec.ts',
-          options: [{ allowInTests: true }],
-        },
-      ],
-      invalid: [
-        {
-          code: 'const body = req.body;',
-          filename: 'handler.ts',
-          options: [{ allowInTests: true }],
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('options - ignorePatterns', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const safeBody = req.body;',
-          options: [{ ignorePatterns: ['safeBody'] }],
-        },
-      ],
-      invalid: [
-        {
-          code: 'const body = req.body;',
-          options: [{ ignorePatterns: ['safeBody'] }],
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('options - trustedLibraries', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: `
-            const schema = myValidator.object({ name: myValidator.string() });
-            const data = schema.parse(req.body);
-          `,
-          options: [{ trustedLibraries: ['myValidator'] }],
-        },
-        {
-          code: 'const data = myLib.validate(req.body);',
-          options: [{ trustedLibraries: ['myLib'] }],
-        },
-        {
-          code: 'const dto = plainToClass(Dto, req.body);',
-        },
-        {
-          code: 'const result = transform(req.body);',
-        },
-      ],
-      invalid: [],
-    });
-
-    ruleTester.run('options - ignorePatterns with invalid regex', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const safeInput = req.body;',
-          options: [{ ignorePatterns: ['['] }], // Invalid regex is treated as literal, but '[' doesn't match 'safeInput', so error is reported
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Edge Cases', () => {
-    ruleTester.run('edge cases - validation method names', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const data = schema.parse(req.body);',
-        },
-        {
-          code: 'const { value } = schema.validate(req.body);',
-        },
-        {
-          code: 'const data = await schema.safeParse(req.body);',
-        },
-        {
-          code: 'const data = await schema.parseAsync(req.body);',
-        },
-      ],
-      invalid: [],
-    });
-
-    ruleTester.run('edge cases - non-user-input identifiers', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const data = someVariable;',
-        },
-        {
-          code: 'const value = config.data;',
-        },
-      ],
-      invalid: [],
-    });
-
-    ruleTester.run('edge cases - checkIdentifier function', noUnvalidatedUserInput, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const userInput = req.body;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-        {
-          code: 'const input = req.query;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-        // 'rawInput' now triggers (explicit unsafe naming)
-        {
-          code: 'const rawInput = req.body;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('edge cases - validation example for different input sources', noUnvalidatedUserInput, {
-      valid: [
-        // 'input' alone is now valid (too many false positives)
-        {
-          code: 'const data = input;',
-        },
-      ],
-      invalid: [
-        // 'unsafeInput' and 'rawInput' still trigger
-        {
-          code: 'const data = unsafeInput;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('edge cases - trusted libraries in validation calls', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const data = myValidator.parse(req.body);',
-          options: [{ trustedLibraries: ['myValidator'] }],
-        },
-        {
-          code: 'const result = customLib.validate(req.query);',
-          options: [{ trustedLibraries: ['customLib'] }],
-        },
-      ],
-      invalid: [],
-    });
-
-    ruleTester.run('edge cases - direct validation function calls', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const dto = plainToClass(Dto, req.body);',
-        },
-        {
-          code: 'const result = transform(req.body);',
-        },
-        {
-          code: 'validate(req.body);',
-        },
-      ],
-      invalid: [],
-    });
-
-    ruleTester.run('edge cases - checkObjectPattern with CallExpression validation', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const { value } = schema.validate(req.body);',
-        },
-        {
-          code: 'const { data } = myLib.parse(req.query);',
-          options: [{ trustedLibraries: ['myLib'] }],
-        },
-        {
-          code: 'const { result } = plainToClass(Dto, req.body);',
-        },
-      ],
-      invalid: [
-        {
-          code: 'const { page, limit } = req.query;',
-          errors: [
-            {
-              messageId: 'unvalidatedInput',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('edge cases - checkObjectPattern with ignorePatterns', noUnvalidatedUserInput, {
-      valid: [
-        {
-          code: 'const { page, limit } = safeQuery;',
-          options: [{ ignorePatterns: ['safeQuery'] }],
-        },
-      ],
-      invalid: [],
-    });
-  });
-});
-

package/src/rules/no-verbose-error-messages/index.ts

@@ -1,83 +0,0 @@
-/**
- * @fileoverview Prevent exposing stack traces to users
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/209.html
- */
-
-import { AST_NODE_TYPES, createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noVerboseErrorMessages = createRule<RuleOptions, MessageIds>({
-  name: 'no-verbose-error-messages',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent exposing stack traces to users',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-209',
-        description: 'Prevent exposing stack traces to users detected - this is a security risk',
-        severity: 'MEDIUM',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/209.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({
-        node,
-        messageId: 'violationDetected',
-      });
-    }
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        
-      // Check res.send/res.json with error.stack
-      if (node.type === AST_NODE_TYPES.CallExpression &&
-          node.callee.type === AST_NODE_TYPES.MemberExpression &&
-          node.callee.property.type === AST_NODE_TYPES.Identifier &&
-          ['send', 'json'].includes(node.callee.property.name)) {
-        
-        const arg = node.arguments[0];
-        
-        // Check for error.stack or err.stack
-        if (arg?.type === AST_NODE_TYPES.MemberExpression &&
-            arg.property.type === AST_NODE_TYPES.Identifier &&
-            arg.property.name === 'stack') {
-          report(node);
-        }
-        
-        // Check for { stack: error.stack } in object
-        if (arg?.type === AST_NODE_TYPES.ObjectExpression) {
-          const stackProp = arg.properties.find(
-            p => p.type === AST_NODE_TYPES.Property &&
-                 p.key.type === AST_NODE_TYPES.Identifier &&
-                 (p.key.name === 'stack' || 
-                  (p.value.type === AST_NODE_TYPES.MemberExpression && 
-                   p.value.property.type === AST_NODE_TYPES.Identifier &&
-                   p.value.property.name === 'stack'))
-          );
-          if (stackProp) {
-            report(node);
-          }
-        }
-      }
-    
-      },
-};
-  },
-});

package/src/rules/no-verbose-error-messages/no-verbose-error-messages.test.ts

@@ -1,34 +0,0 @@
-/**
- * @fileoverview Tests for no-verbose-error-messages
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noVerboseErrorMessages } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-verbose-error-messages', noVerboseErrorMessages, {
-  valid: [
-    // Safe error responses
-    { code: "res.send('Error occurred')" },
-    { code: "res.json({ error: 'Internal error' })" },
-    { code: "res.json({ message: 'Something went wrong' })" },
-    // Non-response calls
-    { code: "console.log(error.stack)" },
-    { code: "logger.error(err.stack)" },
-  ],
-
-  invalid: [
-    // Exposing stack directly
-    { code: "res.send(error.stack)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "res.json(err.stack)", errors: [{ messageId: 'violationDetected' }] },
-    // Exposing stack in object
-    { code: "res.json({ stack: error.stack })", errors: [{ messageId: 'violationDetected' }] },
-    { code: "res.send({ error: err.stack })", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});