eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-insecure-redirects/index.d.ts

@@ -0,0 +1,7 @@
+export interface Options {
+    /** Ignore in test files. Default: true */
+    ignoreInTests?: boolean;
+    /** Allowed redirect domains. Default: [] */
+    allowedDomains?: string[];
+}
+export declare const noInsecureRedirects: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;

package/src/rules/no-insecure-redirects/index.js

@@ -0,0 +1,216 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noInsecureRedirects = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Check if redirect URL is validated
+ */
+function isRedirectValidated(node, sourceCode) {
+    const callText = sourceCode.getText(node);
+    // Check if URL is from user input (req.query, req.body, req.params)
+    const userInputPattern = /\b(req\.(query|body|params)|window\.location|document\.location)\b/;
+    if (!userInputPattern.test(callText)) {
+        // Not from user input, assume safe
+        return true;
+    }
+    // Look for validation patterns in the surrounding code
+    // This is a simplified static analysis - in practice, would need data flow analysis
+    const program = sourceCode.ast;
+    const nodeStart = node.loc?.start;
+    const nodeEnd = node.loc?.end;
+    /* c8 ignore start -- Guard clause: loc is always present in RuleTester */
+    if (!nodeStart || !nodeEnd || !program) {
+        return false;
+    }
+    /* c8 ignore stop */
+    // Check for validation function calls before this redirect
+    const validationPatterns = [
+        /\b(validateUrl|validateRedirect|isValidUrl|isSafeUrl)\s*\(/,
+        /\b(whitelist|allowedDomains|permittedUrls)\s*\./,
+        /\b(url\.hostname|url\.host)\s*===/,
+        /\ballowedDomains\.includes\s*\(/,
+        /\bstartsWith\s*\(\s*['"]/,
+        /\bendsWith\s*\(\s*['"]/,
+        /\bindexOf\s*\(\s*['"]/,
+        /\bmatch\s*\(\s*\//,
+    ];
+    // Look for validation in the same function scope
+    let current = node;
+    let depth = 0;
+    const maxDepth = 20;
+    while (current && depth < maxDepth) {
+        // Check siblings before this node
+        const parent = current.parent;
+        if (!parent)
+            break;
+        if (parent.type === 'BlockStatement') {
+            const body = parent.body;
+            const currentIndex = body.indexOf(current);
+            // Check previous statements in the same block
+            for (let i = currentIndex - 1; i >= 0 && i >= currentIndex - 5; i--) {
+                const stmt = body[i];
+                const stmtText = sourceCode.getText(stmt);
+                if (validationPatterns.some(pattern => pattern.test(stmtText))) {
+                    return true; // Found validation
+                }
+            }
+        }
+        current = parent;
+        depth++;
+    }
+    // No validation found
+    return false;
+}
+exports.noInsecureRedirects = (0, eslint_devkit_2.createRule)({
+    name: 'no-insecure-redirects',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects open redirect vulnerabilities',
+        },
+        hasSuggestions: true,
+        messages: {
+            insecureRedirect: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Open redirect',
+                cwe: 'CWE-601',
+                description: 'Unvalidated redirect detected - user-controlled URL',
+                severity: 'HIGH',
+                fix: 'Whitelist allowed domains or validate redirect target',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Unvalidated_Redirects_and_Forwards',
+            }),
+            whitelistDomains: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Whitelist Domains',
+                description: 'Whitelist allowed redirect domains',
+                severity: 'LOW',
+                fix: 'if (allowedDomains.includes(url.hostname)) redirect(url)',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Unvalidated_Redirects_and_Forwards',
+            }),
+            validateRedirect: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Validate Redirect',
+                description: 'Validate redirect URL before use',
+                severity: 'LOW',
+                fix: 'validateRedirectUrl(userInput) before redirect',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Unvalidated_Redirects_and_Forwards',
+            }),
+            useRelativeUrl: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Relative URL',
+                description: 'Use relative URLs for internal redirects',
+                severity: 'LOW',
+                fix: 'redirect("/internal/path") instead of absolute URLs',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/Unvalidated_Redirects_and_Forwards',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ignoreInTests: {
+                        type: 'boolean',
+                        default: true,
+                    },
+                    allowedDomains: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            ignoreInTests: true,
+            allowedDomains: [],
+        },
+    ],
+    create(context, [options = {}]) {
+        const { ignoreInTests = true } = options || {};
+        const filename = context.getFilename();
+        const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        if (isTestFile) {
+            return {};
+        }
+        const sourceCode = context.sourceCode || context.sourceCode;
+        /**
+         * Check redirect calls and assignments
+         */
+        function checkCallExpression(node) {
+            // Check for res.redirect, window.location, etc.
+            if (node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier') {
+                const methodName = node.callee.property.name;
+                if (['redirect', 'replace', 'assign'].includes(methodName)) {
+                    // Check if redirect URL is validated
+                    if (!isRedirectValidated(node, sourceCode)) {
+                        context.report({
+                            node,
+                            messageId: 'insecureRedirect',
+                            suggest: [
+                                {
+                                    messageId: 'whitelistDomains',
+                                    fix: () => null,
+                                },
+                                {
+                                    messageId: 'validateRedirect',
+                                    fix: () => null,
+                                },
+                                {
+                                    messageId: 'useRelativeUrl',
+                                    fix: () => null,
+                                },
+                            ],
+                        });
+                    }
+                }
+            }
+        }
+        /**
+         * Check assignment expressions like window.location.href = ...
+         */
+        function checkAssignmentExpression(node) {
+            // Check for window.location.href assignments
+            if (node.left.type === 'MemberExpression' &&
+                node.left.object.type === 'MemberExpression' &&
+                node.left.object.object.type === 'Identifier' &&
+                node.left.object.object.name === 'window' &&
+                node.left.object.property.type === 'Identifier' &&
+                node.left.object.property.name === 'location' &&
+                node.left.property.type === 'Identifier' &&
+                ['href', 'replace', 'assign'].includes(node.left.property.name)) {
+                // Check if assignment value comes from user input
+                const rightText = sourceCode.getText(node.right);
+                const userInputPattern = /\b(req\.(query|body|params)|window\.location|document\.location)\b/;
+                if (userInputPattern.test(rightText)) {
+                    context.report({
+                        node,
+                        messageId: 'insecureRedirect',
+                        suggest: [
+                            {
+                                messageId: 'whitelistDomains',
+                                fix: () => null,
+                            },
+                            {
+                                messageId: 'validateRedirect',
+                                fix: () => null,
+                            },
+                            {
+                                messageId: 'useRelativeUrl',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                }
+            }
+        }
+        return {
+            CallExpression: checkCallExpression,
+            AssignmentExpression: checkAssignmentExpression,
+        };
+    },
+});

package/src/rules/no-insecure-websocket/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Require secure WebSocket connections (wss://)
+ */
+export interface Options {
+}
+export declare const noInsecureWebsocket: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;

package/src/rules/no-insecure-websocket/index.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * @fileoverview Require secure WebSocket connections (wss://)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noInsecureWebsocket = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noInsecureWebsocket = (0, eslint_devkit_1.createRule)({
+    name: 'no-insecure-websocket',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require secure WebSocket connections (wss://)',
+        },
+        messages: {
+            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Insecure WebSocket',
+                cwe: 'CWE-319',
+                description: 'Insecure WebSocket connection (ws://) - data transmitted in clear text',
+                severity: 'HIGH',
+                fix: 'Use wss:// instead of ws:// for secure WebSocket connections',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/319.html',
+            })
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        function report(node) {
+            context.report({ node, messageId: 'violationDetected' });
+        }
+        return {
+            NewExpression(node) {
+                // Check for new WebSocket('ws://...')
+                if (node.callee.type === 'Identifier' && node.callee.name === 'WebSocket') {
+                    const urlArg = node.arguments[0];
+                    // Check literal string
+                    if (urlArg && urlArg.type === 'Literal' &&
+                        typeof urlArg.value === 'string' &&
+                        urlArg.value.startsWith('ws://')) {
+                        report(node);
+                    }
+                    // Check template literal
+                    if (urlArg && urlArg.type === 'TemplateLiteral') {
+                        const text = context.sourceCode.getText(urlArg);
+                        if (text.includes('ws://')) {
+                            report(node);
+                        }
+                    }
+                }
+            },
+            Literal(node) {
+                // Check for ws:// URLs in string literals
+                if (typeof node.value === 'string' && node.value.startsWith('ws://')) {
+                    report(node);
+                }
+            },
+        };
+    },
+});

package/src/rules/no-ldap-injection/index.d.ts

@@ -0,0 +1,10 @@
+import { type SecurityRuleOptions } from '@interlace/eslint-devkit';
+export interface Options extends SecurityRuleOptions {
+    /** LDAP-related function names to check */
+    ldapFunctions?: string[];
+    /** Functions that safely escape LDAP input */
+    ldapEscapeFunctions?: string[];
+    /** Functions that validate LDAP input */
+    ldapValidationFunctions?: string[];
+}
+export declare const noLdapInjection: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;