eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/detect-eval-with-expression/detect-eval-with-expression.test.ts

@@ -1,416 +0,0 @@
-/**
- * Comprehensive tests for detect-eval-with-expression rule  
- * Security: CWE-95 (Code Injection)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { detectEvalWithExpression } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-// Use Flat Config format (ESLint 9+)
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('detect-eval-with-expression', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - no eval calls', detectEvalWithExpression, {
-      valid: [
-        'const x = Math.eval();',
-        'const obj = { eval: () => {} }; obj.eval("code");',
-        'function myFunction(data) { return data; }',
-        'const result = calculateValue();',
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Dangerous eval() Calls', () => {
-    ruleTester.run('invalid - eval with expressions', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(userInput);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'eval(`code: ${value}`);',
-          errors: [{ messageId: 'useTemplateLiteral' }],
-        },
-        {
-          code: 'const result = eval(expression);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: `
-            function process(code) {
-              return eval(code);
-            }
-          `,
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('eval() in Different Contexts', () => {
-    ruleTester.run('invalid - eval in various contexts', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const runner = (code) => eval(code);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: `
-            if (condition) {
-              eval(code);
-            }
-          `,
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: `
-            try {
-              eval(code);
-            } catch (e) {
-              console.error(e);
-            }
-          `,
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Multiple eval() Calls', () => {
-    ruleTester.run('invalid - multiple evals', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: `
-            eval(code1);
-            eval(code2);
-          `,
-          errors: [
-            { messageId: 'strategyRefactor' },
-            { messageId: 'strategyRefactor' },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('eval() with Complex Expressions', () => {
-    ruleTester.run('invalid - complex expressions', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(a || b);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: `
-            const code = getCode();
-            eval(code);
-          `,
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Edge Cases', () => {
-    ruleTester.run('edge cases', detectEvalWithExpression, {
-      valid: [
-        'const evalString = "eval(code)"; console.log(evalString);',
-      ],
-      invalid: [
-        {
-          code: '(eval)(code);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Pattern Detection - JSON (lines 187-195)', () => {
-    ruleTester.run('pattern detection - JSON', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval("JSON.parse(" + jsonString + ")");',
-          errors: [
-            {
-              messageId: 'useJsonParse',
-              // Note: Rule provides suggestions but fix returns null (no auto-fix)
-              // Test framework requires output for suggestions, so we don't test them here
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Pattern Detection - Object (lines 211-219)', () => {
-    ruleTester.run('pattern detection - object', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval("obj[" + key + "]");',
-          errors: [
-            {
-              messageId: 'useObjectAccess',
-              // Note: Rule provides suggestions but fix returns null (no auto-fix)
-            },
-          ],
-        },
-        {
-          code: 'eval("object[" + key + "]");',
-          errors: [{ messageId: 'useObjectAccess' }],
-        },
-        {
-          code: 'eval("obj." + property);',
-          errors: [{ messageId: 'useObjectAccess' }],
-        },
-      ],
-    });
-  });
-
-  describe('Uncovered Lines', () => {
-    // Line 219: Default case in generateRefactoringSteps
-    // This is triggered when the pattern doesn't match 'json', 'math', 'object', or 'template'
-    ruleTester.run('line 219 - default case in generateRefactoringSteps', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval("someOtherPattern" + value);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'eval("customPattern" + data);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-
-    // Note: Line 327 default case is not reachable with current pattern definitions
-    // All patterns have known categories ('json', 'math', 'template', 'object')
-  });
-
-  describe('Pattern Detection - Math (lines 194-200)', () => {
-    ruleTester.run('pattern detection - math', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(\'Math.sin(\' + angle + \')\');',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'eval("parseInt(" + value + ")");',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'eval("parseFloat(" + num + ")");',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Pattern Detection - Template (lines 202-208)', () => {
-    ruleTester.run('pattern detection - template', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval("${" + name + "}");',
-          errors: [
-            {
-              messageId: 'useTemplateLiteral',
-              // Note: Rule provides suggestions but fix returns null (no auto-fix)
-            },
-          ],
-        },
-        {
-          code: 'eval("template " + variable);',
-          errors: [{ messageId: 'useTemplateLiteral' }],
-        },
-        {
-          code: 'eval("interpolat" + value);',
-          errors: [{ messageId: 'useTemplateLiteral' }],
-        },
-      ],
-    });
-  });
-
-  describe('Options - allowLiteralStrings (line 254)', () => {
-    ruleTester.run('allowLiteralStrings option', detectEvalWithExpression, {
-      valid: [
-        {
-          code: 'eval("literal string");',
-          options: [{ allowLiteralStrings: true }],
-        },
-        {
-          code: 'eval(\'another literal\');',
-          options: [{ allowLiteralStrings: true }],
-        },
-      ],
-      invalid: [
-        {
-          code: 'eval(userInput);',
-          options: [{ allowLiteralStrings: true }],
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Options - strategy (lines 246-250)', () => {
-    ruleTester.run('strategy remove option', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(userInput);',
-          options: [{ strategy: 'remove' }],
-          errors: [{ messageId: 'strategyRemove' }],
-        },
-      ],
-    });
-
-    ruleTester.run('strategy refactor option', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(userInput);',
-          options: [{ strategy: 'refactor' }],
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-
-    ruleTester.run('strategy validate option', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval(userInput);',
-          options: [{ strategy: 'validate' }],
-          errors: [{ messageId: 'strategyValidate' }],
-        },
-      ],
-    });
-  });
-
-  describe('Edge Cases - Literal String (line 261)', () => {
-    ruleTester.run('edge cases - literal string eval', detectEvalWithExpression, {
-      valid: [
-        // eval with literal string is allowed by default (line 261)
-        'eval("literal string");',
-        "eval('literal string');",
-      ],
-      invalid: [
-        {
-          code: 'eval(variable);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Edge Cases - No Arguments (line 239)', () => {
-    ruleTester.run('edge cases - no arguments', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'eval();',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Function Constructor - CallExpression (lines 298-300)', () => {
-    ruleTester.run('function constructor in call expression', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        // Lines 298-300: Function constructor detection in CallExpression context
-        // This covers the case where Function is called as a function, not as a constructor
-        {
-          code: 'Function(code);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'Function("arg1", "arg2", "return arg1 + arg2");',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        // Lines 401-403: Edge case where new Function is called as a function
-        // This triggers both CallExpression and NewExpression checks
-        {
-          code: '(new Function)(code);',
-          errors: [
-            { messageId: 'strategyRefactor' }, // CallExpression check
-            { messageId: 'strategyRefactor' }  // NewExpression check
-          ],
-        },
-        {
-          code: '(new Function)("arg1", "return arg1 * 2");',
-          errors: [
-            { messageId: 'strategyRefactor' }, // CallExpression check
-            { messageId: 'strategyRefactor' }  // NewExpression check
-          ],
-        },
-        {
-          code: 'new Function(code);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'new Function("arg1", "arg2", "return arg1 + arg2");',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Function Constructor - NewExpression (lines 324-328)', () => {
-    ruleTester.run('function constructor in new expression', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'const fn = new Function(userCode);',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'const fn = new Function("x", "y", "return x + y");',
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-
-  describe('Additional Eval Functions', () => {
-    ruleTester.run('additional eval functions option', detectEvalWithExpression, {
-      valid: [],
-      invalid: [
-        {
-          code: 'customEval(userCode);',
-          options: [{ additionalEvalFunctions: ['customEval'] }],
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-        {
-          code: 'myEval(code);',
-          options: [{ additionalEvalFunctions: ['myEval', 'anotherEval'] }],
-          errors: [{ messageId: 'strategyRefactor' }],
-        },
-      ],
-    });
-  });
-});