eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/require-data-minimization/require-data-minimization.test.ts

@@ -1,31 +0,0 @@
-/**
- * @fileoverview Tests for require-data-minimization
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireDataMinimization } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-data-minimization', requireDataMinimization, {
-  valid: [
-    // Small objects are fine
-    { code: "const user = { name: 'John', email: 'john@example.com' }" },
-    { code: "const data = { a: 1, b: 2, c: 3 }" },
-    // Large objects without PII
-    { code: "const config = { a: 1, b: 2, c: 3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9, j: 10, k: 11 }" },
-  ],
-
-  invalid: [
-    // Large object with user data fields (>10 properties with PII)
-    { 
-      code: "const userData = { email: e, name: n, age: a, city: c, zip: z, phone: p, address: addr, country: co, state: s, company: comp, job: j }",
-      errors: [{ messageId: 'violationDetected' }]
-    },
-  ],
-});

package/src/rules/require-dependency-integrity/index.ts

@@ -1,78 +0,0 @@
-/**
- * @fileoverview Require integrity hashes for external resources
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requireDependencyIntegrity = createRule<RuleOptions, MessageIds>({
-  name: 'require-dependency-integrity',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Require SRI (Subresource Integrity) for CDN resources',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Missing SRI',
-        cwe: 'CWE-494',
-        description: 'External resource loaded without integrity hash - supply chain risk',
-        severity: 'HIGH',
-        fix: 'Add integrity="sha384-..." and crossorigin="anonymous" attributes',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/494.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    return {
-      Literal(node: TSESTree.Literal) {
-        if (typeof node.value !== 'string') return;
-        
-        // Check for script/link tags without integrity
-        const value = node.value.toLowerCase();
-        if ((value.includes('<script') && value.includes('src=')) ||
-            (value.includes('<link') && value.includes('href='))) {
-          
-          // Check if CDN source
-          if (value.includes('cdn.') || value.includes('cdnjs.') || 
-              value.includes('unpkg.') || value.includes('jsdelivr.')) {
-            
-            if (!value.includes('integrity=')) {
-              report(node);
-            }
-          }
-        }
-      },
-      
-      TemplateLiteral(node: TSESTree.TemplateLiteral) {
-        const text = context.sourceCode.getText(node).toLowerCase();
-        
-        if ((text.includes('<script') && text.includes('src=')) ||
-            (text.includes('<link') && text.includes('href='))) {
-          
-          if (text.includes('cdn.') || text.includes('cdnjs.') || 
-              text.includes('unpkg.') || text.includes('jsdelivr.')) {
-            
-            if (!text.includes('integrity=')) {
-              report(node);
-            }
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/require-dependency-integrity/require-dependency-integrity.test.ts

@@ -1,44 +0,0 @@
-/**
- * @fileoverview Tests for require-dependency-integrity
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireDependencyIntegrity } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-dependency-integrity', requireDependencyIntegrity, {
-  valid: [
-    // Resources with integrity
-    { code: "const html = '<script src=\"https://cdn.example.com/lib.js\" integrity=\"sha384-abc\"></script>'" },
-    { code: "const link = '<link href=\"https://cdnjs.cloudflare.com/style.css\" integrity=\"sha256-xyz\">'" },
-    // Non-CDN resources
-    { code: "const script = '<script src=\"/local/app.js\"></script>'" },
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // CDN resources without integrity
-    { 
-      code: "const html = '<script src=\"https://cdn.example.com/lib.js\"></script>'",
-      errors: [{ messageId: 'violationDetected' }]
-    },
-    { 
-      code: "const link = '<link href=\"https://cdnjs.cloudflare.com/style.css\">'",
-      errors: [{ messageId: 'violationDetected' }]
-    },
-    { 
-      code: "const js = '<script src=\"https://unpkg.com/react@17/umd/react.js\"></script>'",
-      errors: [{ messageId: 'violationDetected' }]
-    },
-    { 
-      code: "`<script src=\"https://jsdelivr.net/lib.js\"></script>`",
-      errors: [{ messageId: 'violationDetected' }]
-    },
-  ],
-});

package/src/rules/require-https-only/index.ts

@@ -1,75 +0,0 @@
-/**
- * @fileoverview Enforce HTTPS for all external requests
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/319.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requireHttpsOnly = createRule<RuleOptions, MessageIds>({
-  name: 'require-https-only',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Enforce HTTPS for all external requests',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M5'],
-      cweIds: ["CWE-319"],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-319',
-        description: 'Enforce HTTPS for all external requests detected - this is a security risk',
-        severity: 'HIGH',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/319.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({
-        node,
-        messageId: 'violationDetected',
-      });
-    }
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        
-      // Check fetch/axios calls with http:// URLs
-      if (node.type === 'CallExpression') {
-        const callee = node.callee;
-        const isHttpCall = 
-          (callee.name === 'fetch' || 
-           (callee.object?.name === 'axios' && 
-            ['get', 'post', 'put', 'delete', 'patch'].includes(callee.property?.name)));
-        
-        if (isHttpCall && node.arguments[0]) {
-          const url = node.arguments[0];
-          if (url.type === 'Literal' && 
-              typeof url.value === 'string' && 
-              url.value.startsWith('http://')) {
-            report(node);
-          }
-        }
-      }
-    
-      },
-      
-      };
-  },
-});

package/src/rules/require-https-only/require-https-only.test.ts

@@ -1,26 +0,0 @@
-/**
- * @fileoverview Tests for require-https-only
- * 
- * Coverage: Comprehensive test suite with valid and invalid cases
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireHttpsOnly } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-https-only', requireHttpsOnly, {
-  valid: [
-    { code: "fetch('https://api.example.com')" },
-    { code: "axios.get('https://secure.io')" }
-  ],
-
-  invalid: [
-    { code: "fetch('http://api.example.com')", errors: [{ messageId: 'violationDetected' }] }
-  ],
-});

package/src/rules/require-mime-type-validation/index.ts

@@ -1,77 +0,0 @@
-/**
- * @fileoverview Require MIME type validation for uploads
- */
-
-import { AST_NODE_TYPES, createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requireMimeTypeValidation = createRule<RuleOptions, MessageIds>({
-  name: 'require-mime-type-validation',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Require MIME type validation for file uploads',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Missing MIME Validation',
-        cwe: 'CWE-434',
-        description: 'File upload without MIME type validation - unrestricted upload vulnerability',
-        severity: 'HIGH',
-        fix: 'Add fileFilter option to validate MIME types',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/434.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Detect multer().single() or multer().array() without fileFilter
-        if (node.callee.type === AST_NODE_TYPES.MemberExpression &&
-            node.callee.property.type === AST_NODE_TYPES.Identifier &&
-            ['single', 'array', 'fields'].includes(node.callee.property.name)) {
-          
-          // Check if parent has fileFilter configuration
-          const calleeObj = node.callee.object;
-          if (calleeObj.type === AST_NODE_TYPES.CallExpression) {
-            const multerArgs = calleeObj.arguments[0];
-            if (multerArgs && multerArgs.type === AST_NODE_TYPES.ObjectExpression) {
-              const hasFileFilter = multerArgs.properties.some(
-                (p) => p.type === AST_NODE_TYPES.Property && p.key.type === AST_NODE_TYPES.Identifier && (p.key.name === 'fileFilter' || p.key.name === 'limits')
-              );
-              if (!hasFileFilter) {
-                report(node);
-              }
-            } else if (!multerArgs) {
-              // No config at all = no validation
-              report(node);
-            }
-          }
-        }
-        
-        // Detect upload() calls directly
-        if (node.callee.type === AST_NODE_TYPES.Identifier && node.callee.name === 'upload') {
-          // Check if there's validation in arguments
-          if (node.arguments.length === 0 || 
-              (node.arguments[0]?.type === AST_NODE_TYPES.Identifier)) {
-            report(node);
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/require-mime-type-validation/require-mime-type-validation.test.ts

@@ -1,32 +0,0 @@
-/**
- * @fileoverview Tests for require-mime-type-validation
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireMimeTypeValidation } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-mime-type-validation', requireMimeTypeValidation, {
-  valid: [
-    // Multer with fileFilter
-    { code: "multer({ fileFilter: validateMime }).single('file')" },
-    { code: "multer({ limits: { fileSize: 1024 } }).single('file')" },
-    // Non-upload calls
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Multer without validation
-    { code: "multer().single('avatar')", errors: [{ messageId: 'violationDetected' }] },
-    { code: "multer().array('photos')", errors: [{ messageId: 'violationDetected' }] },
-    // Direct upload call without validation
-    { code: "upload(file)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "upload()", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/require-network-timeout/index.ts

@@ -1,58 +0,0 @@
-/**
- * @fileoverview Require timeout limits for network requests
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/770.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requireNetworkTimeout = createRule<RuleOptions, MessageIds>({
-  name: 'require-network-timeout',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Require timeout limits for network requests',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M5'],
-      cweIds: ["CWE-770"],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-400',
-        description: 'Require timeout limits for network requests detected - fetch/axios without timeout option',
-        severity: 'MEDIUM',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/400.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    return {
-      
-      CallExpression(node: TSESTree.CallExpression) {
-        if (node.callee.name === 'fetch' || 
-            (node.callee.type === 'MemberExpression' && 
-             node.callee.object.name === 'axios')) {
-          const hasTimeout = node.arguments[1]?.type === 'ObjectExpression' &&
-            node.arguments[1].properties.some(p => p.key?.name === 'timeout');
-          if (!hasTimeout) {
-            context.report({ node, messageId: 'violationDetected' });
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/require-network-timeout/require-network-timeout.test.ts

@@ -1,26 +0,0 @@
-/**
- * @fileoverview Tests for require-network-timeout
- * 
- * Coverage: Comprehensive test suite with valid and invalid cases
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireNetworkTimeout } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-network-timeout', requireNetworkTimeout, {
-  valid: [
-    { code: "fetch(url, { timeout: 5000 })" },
-    { code: "axios.get(url, { timeout: 10000 })" }
-  ],
-
-  invalid: [
-    { code: "fetch(url)", errors: [{ messageId: 'violationDetected' }] }
-  ],
-});

package/src/rules/require-package-lock/index.ts

@@ -1,75 +0,0 @@
-/**
- * @fileoverview Ensure package lock file exists
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/829.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requirePackageLock = createRule<RuleOptions, MessageIds>({
-  name: 'require-package-lock',
-  meta: {
-    type: 'suggestion',
-    docs: {
-      description: 'Ensure package-lock.json or yarn.lock exists',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M2'],
-      cweIds: ['CWE-829'],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-829',
-        description: 'Package lock file missing - commit package-lock',
-        severity: 'HIGH',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/829.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    const fs = require('node:fs');
-    const path = require('node:path');
-    
-    // Check once per file
-    let checked = false;
-    
-    return {
-      Program(node: TSESTree.Program) {
-        if (checked) return;
-        checked = true;
-        
-        // Find project root (simplified)
-        let dir = path.dirname(context.filename);
-        let found = false;
-        
-        for (let i = 0; i < 10; i++) {
-          if (fs.existsSync(path.join(dir, 'package-lock.json')) ||
-              fs.existsSync(path.join(dir, 'yarn.lock')) ||
-              fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))) {
-            found = true;
-            break;
-          }
-          dir = path.dirname(dir);
-        }
-        
-        if (!found) {
-          context.report({ node, messageId: 'violationDetected' });
-        }
-      },
-    };
-  },
-});
-

package/src/rules/require-package-lock/require-package-lock.test.ts

@@ -1,27 +0,0 @@
-/**
- * @fileoverview Tests for require-package-lock
- * 
- * NOTE: This rule checks for package-lock.json, yarn.lock, or pnpm-lock.yaml
- * in the file system. Since this monorepo has pnpm-lock.yaml, tests should pass.
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requirePackageLock } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-package-lock', requirePackageLock, {
-  valid: [
-    // Any code is valid since lock file exists in this repo
-    { code: "const x = 1", filename: __filename },
-  ],
-
-  invalid: [
-    // Cannot test invalid case since lock file exists
-  ],
-});

package/src/rules/require-secure-credential-storage/index.ts

@@ -1,60 +0,0 @@
-/**
- * @fileoverview Enforce secure storage patterns for credentials
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/522.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const requireSecureCredentialStorage = createRule<RuleOptions, MessageIds>({
-  name: 'require-secure-credential-storage',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Enforce secure storage patterns for credentials',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M1'],
-      cweIds: ["CWE-522"],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-312',
-        description: 'Enforce secure storage patterns for credentials detected - Credentials without encryption',
-        severity: 'HIGH',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/312.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    return {
-      
-      CallExpression(node: TSESTree.CallExpression) {
-        if (node.callee.type === 'MemberExpression' &&
-            ['setItem', 'writeFile'].includes(node.callee.property.name)) {
-          // Check for encryption wrapper
-          const hasEncryption = node.arguments.some(arg =>
-            arg.type === 'CallExpression' &&
-            arg.callee.name?.includes('encrypt')
-          );
-          if (!hasEncryption) {
-            context.report({ node, messageId: 'violationDetected' });
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/require-secure-credential-storage/require-secure-credential-storage.test.ts

@@ -1,26 +0,0 @@
-/**
- * @fileoverview Tests for require-secure-credential-storage
- * 
- * Coverage: Comprehensive test suite with valid and invalid cases
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { requireSecureCredentialStorage } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('require-secure-credential-storage', requireSecureCredentialStorage, {
-  valid: [
-    { code: "await Keychain.setPassword(service, password)" },
-    { code: "SecureStore.setItemAsync('key', value)" }
-  ],
-
-  invalid: [
-    { code: "AsyncStorage.setItem('apiKey', key)", errors: [{ messageId: 'violationDetected' }] }
-  ],
-});