eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-ldap-injection/index.js

@@ -0,0 +1,455 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noLdapInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+const eslint_devkit_3 = require("@interlace/eslint-devkit");
+exports.noLdapInjection = (0, eslint_devkit_1.createRule)({
+    name: 'no-ldap-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects LDAP injection vulnerabilities',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            ldapInjection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'LDAP Injection',
+                cwe: 'CWE-90',
+                description: 'LDAP injection vulnerability detected',
+                severity: '{{severity}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            unsafeLdapFilter: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe LDAP Filter',
+                cwe: 'CWE-90',
+                description: 'LDAP filter constructed with unsafe string operations',
+                severity: 'HIGH',
+                fix: 'Use ldap.escape.filterValue() to escape user input',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            unescapedLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unescaped LDAP Input',
+                cwe: 'CWE-90',
+                description: 'LDAP operation uses unescaped user input',
+                severity: 'MEDIUM',
+                fix: 'Escape all user input before LDAP operations',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            dangerousLdapOperation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Dangerous LDAP Operation',
+                cwe: 'CWE-90',
+                description: 'LDAP operation allows dangerous filter patterns',
+                severity: 'HIGH',
+                fix: 'Validate LDAP filters and restrict allowed operations',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            useLdapEscaping: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use LDAP Escaping',
+                description: 'Use proper LDAP escaping functions',
+                severity: 'LOW',
+                fix: 'Use ldap.escape.filterValue() or equivalent',
+                documentationLink: 'https://www.npmjs.com/package/ldap-escape',
+            }),
+            validateLdapInput: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Validate LDAP Input',
+                description: 'Validate LDAP input before processing',
+                severity: 'LOW',
+                fix: 'Validate input against allowed patterns',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            useParameterizedLdap: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.INFO,
+                issueName: 'Use Parameterized LDAP',
+                description: 'Use parameterized LDAP queries when possible',
+                severity: 'LOW',
+                fix: 'Use prepared LDAP statements or safe construction',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            }),
+            strategyInputValidation: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Input Validation Strategy',
+                description: 'Validate LDAP input at application boundary',
+                severity: 'LOW',
+                fix: 'Implement input validation and length limits',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/90.html',
+            }),
+            strategySafeLibraries: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Safe Libraries Strategy',
+                description: 'Use LDAP libraries with built-in escaping',
+                severity: 'LOW',
+                fix: 'Use ldapjs or libraries with automatic escaping',
+                documentationLink: 'https://www.npmjs.com/package/ldapjs',
+            }),
+            strategyFilterConstruction: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.STRATEGY,
+                issueName: 'Filter Construction Strategy',
+                description: 'Use safe LDAP filter construction methods',
+                severity: 'LOW',
+                fix: 'Build filters programmatically with escaped values',
+                documentationLink: 'https://ldap.com/ldap-filters/',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ldapFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
+                    },
+                    ldapEscapeFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
+                    },
+                    ldapValidationFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional function names to consider as LDAP sanitizers',
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional JSDoc annotations to consider as safe markers',
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Disable all false positive detection (strict mode)',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            ldapFunctions: ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'],
+            ldapEscapeFunctions: ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'],
+            ldapValidationFunctions: ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'],
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { ldapFunctions = ['search', 'bind', 'modify', 'add', 'delete', 'compare', 'searchAsync'], ldapEscapeFunctions = ['escape.filterValue', 'escape.dnValue', 'filterEscape', 'dnEscape'], ldapValidationFunctions = ['validateLdapInput', 'sanitizeLdapFilter', 'cleanLdapValue', 'checkLdapFilter'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
+        const sourceCode = context.sourceCode || context.sourceCode;
+        const filename = context.filename || context.filename;
+        // Create safety checker for false positive detection
+        const safetyChecker = (0, eslint_devkit_3.createSafetyChecker)({
+            trustedSanitizers,
+            trustedAnnotations,
+            trustedOrmPatterns: [],
+            strictMode,
+        });
+        /**
+         * Check if this is an LDAP-related operation
+         */
+        const isLdapOperation = (node) => {
+            const callee = node.callee;
+            // Check for LDAP method calls
+            if (callee.type === 'MemberExpression' &&
+                callee.property.type === 'Identifier' &&
+                ldapFunctions.includes(callee.property.name)) {
+                return true;
+            }
+            return false;
+        };
+        /**
+         * Check if LDAP filter contains dangerous patterns
+         */
+        const containsDangerousLdapFilter = (filterText) => {
+            // Dangerous LDAP filter patterns
+            const dangerousPatterns = [
+                /\*\)$/, // Ending with *) to match everything
+                /\|\)$/, // Ending with |) for OR operations
+                /&\)$/, // Ending with &) for AND operations
+                /!\)$/, // Ending with !) for NOT operations
+                /\*\|\*/, // *|* pattern for matching everything
+                /\*&\*/, // *&* pattern
+                /\*!/, // NOT operations that could be exploited
+            ];
+            return dangerousPatterns.some(pattern => pattern.test(filterText));
+        };
+        /**
+         * Check if string contains LDAP filter interpolation
+         */
+        const containsLdapInterpolation = (text) => {
+            return /\$\{[^}]+\}/.test(text) || /'[^']*\+[^+]*'/.test(text) || /"[^"]*\+[^+]*"/.test(text);
+        };
+        /**
+         * Check if LDAP input is from untrusted source
+         */
+        const isUntrustedLdapInput = (inputNode) => {
+            // Check member expressions like req.query.name, req.params.id, etc.
+            if (inputNode.type === 'MemberExpression') {
+                const fullName = sourceCode.getText(inputNode).toLowerCase();
+                return fullName.includes('req.') || fullName.includes('request.') ||
+                    fullName.includes('query.') || fullName.includes('params.') ||
+                    fullName.includes('body.');
+            }
+            // In test contexts, also consider certain variable names as potentially untrusted
+            if (inputNode.type === 'Identifier') {
+                const varName = inputNode.name.toLowerCase();
+                return ['userid', 'username', 'userinput', 'input', 'term', 'name', 'search', 'query', 'param', 'password', 'id', 'dn'].includes(varName) ||
+                    varName.startsWith('user') || varName.startsWith('input') || varName.endsWith('input') ||
+                    varName.includes('user') || varName.includes('input');
+            }
+            return false;
+        };
+        /**
+         * Check if LDAP input has been escaped
+         */
+        const isLdapInputEscaped = (inputNode) => {
+            let current = inputNode;
+            while (current) {
+                if (current.type === 'CallExpression') {
+                    const callee = current.callee;
+                    // Check for escape function calls
+                    if (callee.type === 'MemberExpression' &&
+                        callee.property.type === 'Identifier') {
+                        const propertyName = callee.property.name;
+                        if (ldapEscapeFunctions.some(escapeFunc => escapeFunc.includes(propertyName) ||
+                            propertyName.includes('escape'))) {
+                            return true;
+                        }
+                    }
+                    // Check for validation function calls
+                    if (callee.type === 'Identifier' &&
+                        ldapValidationFunctions.includes(callee.name)) {
+                        return true;
+                    }
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        return {
+            // Check LDAP function calls
+            CallExpression(node) {
+                if (!isLdapOperation(node)) {
+                    return;
+                }
+                const args = node.arguments;
+                if (args.length < 2) {
+                    return; // Need at least base DN and filter/options
+                }
+                // Check filter argument (usually the second argument)
+                const filterArg = args[1];
+                // Check if filter argument comes from untrusted input (like req.query.filter)
+                if (isUntrustedLdapInput(filterArg)) {
+                    /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                    if (safetyChecker.isSafe(filterArg, context)) {
+                        return;
+                    }
+                    /* c8 ignore stop */
+                    context.report({
+                        node: filterArg,
+                        messageId: 'unescapedLdapInput',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useLdapEscaping',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                }
+                else if (filterArg.type === 'TemplateLiteral' && filterArg.expressions.length > 0) {
+                    // Special handling for template literals with any expressions in LDAP calls
+                    // This is a more aggressive check for LDAP injection in function calls
+                    const hasAnyExpression = filterArg.expressions.some(() => true);
+                    if (hasAnyExpression) {
+                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                        if (safetyChecker.isSafe(filterArg, context)) {
+                            return;
+                        }
+                        /* c8 ignore stop */
+                        context.report({
+                            node: filterArg,
+                            messageId: 'unescapedLdapInput',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                            suggest: [
+                                {
+                                    messageId: 'useLdapEscaping',
+                                    fix: () => null,
+                                },
+                            ],
+                        });
+                    }
+                }
+            },
+            // Check variable declarations with LDAP filters
+            VariableDeclarator(node) {
+                if (!node.init || node.id.type !== 'Identifier') {
+                    return;
+                }
+                const varName = node.id.name.toLowerCase();
+                // Check if variable name suggests LDAP-related content
+                const isLdapRelated = varName.includes('filter') || varName.includes('ldap') ||
+                    varName.includes('query') || varName.includes('search') ||
+                    varName.includes('dn') || varName.includes('bind');
+                // If not obviously LDAP-related, check if the assigned value looks like LDAP
+                if (!isLdapRelated && node.init) {
+                    const initText = sourceCode.getText(node.init);
+                    if (!initText.includes('(') || !initText.includes(')')) {
+                        return;
+                    }
+                }
+                // Check if assigned value contains dangerous LDAP patterns
+                if (node.init.type === 'Literal' && typeof node.init.value === 'string') {
+                    if (containsDangerousLdapFilter(node.init.value)) {
+                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                        if (safetyChecker.isSafe(node.init, context)) {
+                            return;
+                        }
+                        /* c8 ignore stop */
+                        context.report({
+                            node: node.init,
+                            messageId: 'dangerousLdapOperation',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+                else if (node.init.type === 'TemplateLiteral') {
+                    // Handle template literals with interpolation
+                    const fullText = sourceCode.getText(node.init);
+                    // Check for interpolation in LDAP-like expressions
+                    if (containsLdapInterpolation(fullText)) {
+                        // Check if any interpolated values are untrusted
+                        const hasUntrustedInterpolation = node.init.expressions.some((expr) => isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr));
+                        if (hasUntrustedInterpolation) {
+                            /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                            if (safetyChecker.isSafe(node.init, context)) {
+                                return;
+                            }
+                            /* c8 ignore stop */
+                            context.report({
+                                node: node.init,
+                                messageId: 'unsafeLdapFilter',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'useLdapEscaping',
+                                        fix: () => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                    // Check for dangerous patterns in template literals
+                    if (containsDangerousLdapFilter(fullText)) {
+                        /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                        if (safetyChecker.isSafe(node.init, context)) {
+                            return;
+                        }
+                        /* c8 ignore stop */
+                        context.report({
+                            node: node.init,
+                            messageId: 'dangerousLdapOperation',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                    }
+                }
+                else if (node.init.type === 'BinaryExpression' && node.init.operator === '+') {
+                    // Handle string concatenation
+                    const fullText = sourceCode.getText(node.init);
+                    // Check if this looks like LDAP filter construction
+                    if (fullText.includes('(') && fullText.includes(')')) {
+                        // Check if untrusted input is involved (recursive check)
+                        const hasUntrustedInput = (expr) => {
+                            if (isUntrustedLdapInput(expr) && !isLdapInputEscaped(expr)) {
+                                return true;
+                            }
+                            if (expr.type === 'BinaryExpression' && expr.operator === '+') {
+                                return hasUntrustedInput(expr.left) || hasUntrustedInput(expr.right);
+                            }
+                            return false;
+                        };
+                        if (hasUntrustedInput(node.init.left) || hasUntrustedInput(node.init.right)) {
+                            /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                            if (safetyChecker.isSafe(node.init, context)) {
+                                return;
+                            }
+                            /* c8 ignore stop */
+                            context.report({
+                                node: node.init,
+                                messageId: 'ldapInjection',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                    severity: 'HIGH',
+                                    safeAlternative: 'Use ldap.escape.filterValue() or parameterized LDAP queries',
+                                },
+                                suggest: [
+                                    {
+                                        messageId: 'useLdapEscaping',
+                                        fix: () => null,
+                                    },
+                                ],
+                            });
+                        }
+                    }
+                }
+                else if (isUntrustedLdapInput(node.init) && !isLdapInputEscaped(node.init)) {
+                    /* c8 ignore start -- safetyChecker requires JSDoc annotations not testable via RuleTester */
+                    if (safetyChecker.isSafe(node.init, context)) {
+                        return;
+                    }
+                    /* c8 ignore stop */
+                    context.report({
+                        node: node.init,
+                        messageId: 'ldapInjection',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                            severity: 'MEDIUM',
+                            safeAlternative: 'Use proper LDAP escaping and validation',
+                        },
+                        suggest: [
+                            {
+                                messageId: 'useLdapEscaping',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                }
+            }
+        };
+    },
+});

package/src/rules/no-missing-authentication/index.d.ts

@@ -0,0 +1,13 @@
+export interface Options {
+    /** Allow missing authentication in test files. Default: false */
+    allowInTests?: boolean;
+    /** Test file pattern regex string. Default: '\\.(test|spec)\\.(ts|tsx|js|jsx)$' */
+    testFilePattern?: string;
+    /** Authentication middleware patterns to recognize. Default: ['authenticate', 'auth', 'requireAuth', 'isAuthenticated'] */
+    authMiddlewarePatterns?: string[];
+    /** Route handler patterns to check. Default: ['get', 'post', 'put', 'delete', 'patch', 'all'] */
+    routeHandlerPatterns?: string[];
+    /** Additional patterns to ignore. Default: [] */
+    ignorePatterns?: string[];
+}
+export declare const noMissingAuthentication: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;