eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-xxe-injection/index.js

@@ -0,0 +1,266 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noXxeInjection = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+exports.noXxeInjection = (0, eslint_devkit_1.createRule)({
+    name: 'no-xxe-injection',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detect XML External Entity (XXE) injection vulnerabilities',
+            url: 'https://cwe.mitre.org/data/definitions/611.html',
+        },
+        messages: {
+            xxeInjection: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'XXE Injection',
+                cwe: 'CWE-611',
+                description: 'XML contains dangerous entity declarations',
+                severity: 'CRITICAL',
+                fix: 'Remove SYSTEM/PUBLIC entity declarations or use safe XML parser',
+                documentationLink: 'https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing',
+            }),
+            unsafeXmlParser: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Unsafe XML Parser',
+                cwe: 'CWE-611',
+                description: 'Using unsafe XML parser without secure configuration',
+                severity: 'HIGH',
+                fix: 'Use libxmljs with noent: false or xmldom with entityResolver: null',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html',
+            }),
+            externalEntityEnabled: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'External Entity Processing',
+                cwe: 'CWE-611',
+                description: 'External entity processing is enabled',
+                severity: 'CRITICAL',
+                fix: 'Disable external entity processing',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/611.html',
+            }),
+            untrustedXmlSource: (0, eslint_devkit_2.formatLLMMessage)({
+                icon: eslint_devkit_2.MessageIcons.SECURITY,
+                issueName: 'Untrusted XML Source',
+                cwe: 'CWE-611',
+                description: 'XML from untrusted source without validation',
+                severity: 'HIGH',
+                fix: 'Validate and sanitize XML input before parsing',
+                documentationLink: 'https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    safeParserOptions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                    },
+                    xmlValidationFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            safeParserOptions: ['noent', 'resolveExternals', 'expandEntityReferences', 'entityResolver'],
+            xmlValidationFunctions: ['validateXml', 'sanitizeXml', 'cleanXml', 'parseXmlSafe'],
+        },
+    ],
+    create(context, [options]) {
+        const { safeParserOptions = ['noent', 'resolveExternals', 'expandEntityReferences', 'entityResolver'], xmlValidationFunctions = ['validateXml', 'sanitizeXml', 'cleanXml', 'parseXmlSafe'], } = options || {};
+        const filename = context.filename || context.getFilename();
+        /**
+         * Check if this is an XML parsing operation
+         */
+        const isXmlParsingCall = (node) => {
+            const callee = node.callee;
+            // Check for XML library method calls
+            if (callee.type === 'MemberExpression' &&
+                callee.property.type === 'Identifier' &&
+                ['parse', 'parseFromString', 'parseString', 'parseXmlString', 'parseXML'].includes(callee.property.name)) {
+                return true;
+            }
+            // Check for constructor calls
+            if (callee.type === 'Identifier' &&
+                ['DOMParser', 'XMLHttpRequest', 'ActiveXObject'].includes(callee.name)) {
+                return true;
+            }
+            return false;
+        };
+        /**
+         * Check if parser options are secure
+         */
+        const hasSecureParserOptions = (optionsNode) => {
+            if (optionsNode.type !== 'ObjectExpression') {
+                return false;
+            }
+            // Check for secure options
+            for (const prop of optionsNode.properties) {
+                if (prop.type === 'Property' &&
+                    prop.key.type === 'Identifier' &&
+                    safeParserOptions.includes(prop.key.name)) {
+                    // Check if the value is secure
+                    if (prop.value.type === 'Literal' && prop.value.value === false) {
+                        return true;
+                    }
+                    if (prop.value.type === 'Literal' && prop.value.value === null) {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        };
+        /**
+         * Check if parser options enable dangerous features
+         */
+        const hasDangerousParserOptions = (optionsNode) => {
+            if (optionsNode.type !== 'ObjectExpression') {
+                return false;
+            }
+            // Check for dangerous options
+            for (const prop of optionsNode.properties) {
+                if (prop.type === 'Property' &&
+                    prop.key.type === 'Identifier' &&
+                    ['resolveExternals', 'expandEntityReferences', 'noent'].includes(prop.key.name)) {
+                    // Check if the value enables dangerous features
+                    if (prop.value.type === 'Literal' && prop.value.value === true) {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        };
+        /**
+         * Check if input has been validated
+         */
+        const isXmlInputValidated = (xmlSource) => {
+            // Check if the input comes from a validation function
+            let current = xmlSource;
+            while (current) {
+                if (current.type === 'CallExpression' &&
+                    current.callee.type === 'Identifier' &&
+                    xmlValidationFunctions.includes(current.callee.name)) {
+                    return true;
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        /**
+         * Check if XML contains dangerous entity declarations
+         */
+        const containsDangerousEntities = (xmlText) => {
+            return /<!ENTITY/i.test(xmlText) &&
+                /SYSTEM\s+["']/i.test(xmlText);
+        };
+        /**
+         * Check if input source is untrusted
+         */
+        const isUntrustedXmlSource = (xmlSource) => {
+            // Check for user input sources
+            if (xmlSource.type === 'Identifier') {
+                const varName = xmlSource.name.toLowerCase();
+                // Consider variables with safe/validated names as trusted
+                if (['clean', 'safe', 'validated', 'sanitized', 'validatedxml', 'sanitizedxml'].some(safe => varName.includes(safe))) {
+                    return false;
+                }
+                return ['req', 'request', 'body', 'query', 'params', 'input', 'xml', 'data'].some(keyword => varName.includes(keyword));
+            }
+            // Check for file system reads (potentially untrusted)
+            let current = xmlSource;
+            while (current) {
+                if (current.type === 'CallExpression' &&
+                    current.callee.type === 'MemberExpression' &&
+                    current.callee.property.type === 'Identifier' &&
+                    ['readFileSync', 'readFile', 'createReadStream'].includes(current.callee.property.name)) {
+                    return true; // File input is potentially untrusted
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        return {
+            // Check XML parsing calls
+            CallExpression(node) {
+                if (!isXmlParsingCall(node)) {
+                    return;
+                }
+                const args = node.arguments;
+                if (args.length === 0) {
+                    return;
+                }
+                // Check XML input source
+                const xmlInput = args[0];
+                const isUntrusted = isUntrustedXmlSource(xmlInput);
+                const isValidated = isXmlInputValidated(xmlInput);
+                // Check if this parser call uses secure options
+                const hasSecureOptions = args.length >= 2 && hasSecureParserOptions(args[1]);
+                // CRITICAL: Untrusted XML input without validation (only if parser is not secure)
+                if (isUntrusted && !isValidated && !hasSecureOptions) {
+                    context.report({
+                        node: xmlInput,
+                        messageId: 'untrustedXmlSource',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                        },
+                    });
+                }
+                // Check for dangerous parser options
+                if (args.length >= 2) {
+                    const optionsArg = args[1];
+                    if (hasDangerousParserOptions(optionsArg)) {
+                        context.report({
+                            node: optionsArg,
+                            messageId: 'externalEntityEnabled',
+                            data: {
+                                filePath: filename,
+                                line: String(node.loc?.start.line ?? 0),
+                            },
+                        });
+                        return;
+                    }
+                    // DOMParser method safety is covered by constructor detection
+                    // No need to report unsafeXmlParser for individual method calls
+                }
+            },
+            // Check XML parser constructor calls
+            NewExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'Identifier' ||
+                    !['DOMParser', 'XMLHttpRequest', 'ActiveXObject'].includes(callee.name)) {
+                    return;
+                }
+                // Constructor calls for XML parsers are considered unsafe
+                context.report({
+                    node,
+                    messageId: 'unsafeXmlParser',
+                    data: {
+                        filePath: filename,
+                        line: String(node.loc?.start.line ?? 0),
+                    },
+                });
+            },
+            // Check for dangerous XML literals
+            Literal(node) {
+                if (typeof node.value === 'string' && containsDangerousEntities(node.value)) {
+                    context.report({
+                        node,
+                        messageId: 'xxeInjection',
+                        data: {
+                            filePath: filename,
+                            line: String(node.loc?.start.line ?? 0),
+                            safeAlternative: 'Use sanitized XML or remove entity declarations',
+                        },
+                    });
+                }
+            },
+        };
+    },
+});

package/src/rules/no-zip-slip/index.d.ts

@@ -0,0 +1,9 @@
+export interface Options {
+    /** Archive extraction functions to check */
+    archiveFunctions?: string[];
+    /** Functions that safely validate archive paths */
+    pathValidationFunctions?: string[];
+    /** Safe archive extraction libraries */
+    safeLibraries?: string[];
+}
+export declare const noZipSlip: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;