eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-clickjacking/no-clickjacking.test.ts

@@ -1,253 +0,0 @@
-/**
- * Comprehensive tests for no-clickjacking rule
- * Security: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noClickjacking } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-// Use Flat Config format (ESLint 9+) with JSX support
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-    parserOptions: {
-      ecmaFeatures: {
-        jsx: true,
-      },
-    },
-  },
-});
-
-describe('no-clickjacking', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - protected against clickjacking', noClickjacking, {
-      valid: [
-        // Trusted iframe sources (starts with /)
-        {
-          code: '<iframe src="/local-content.html"></iframe>',
-        },
-        // Proper CSP (would be set server-side) - no UI elements
-        {
-          code: '// CSP: frame-ancestors \'self\'; const x = 1;',
-        },
-        // Code without UI elements doesn't require frame-busting
-        {
-          code: 'const data = { name: "test" };',
-        },
-        // Frame-busting detection (marks hasFrameBusting=true)
-        {
-          code: 'if (top != self) { console.log("framed"); }',
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Missing Frame Busting', () => {
-    // Note: missingFrameBusting now only triggers on entry point files (index/app/page.tsx/jsx)
-    // These tests use the default test filename which is not an entry point
-    ruleTester.run('valid - non-entry-point files skip frame-busting check', noClickjacking, {
-      valid: [
-        // Code with button (UI element) but no frame-busting - now valid since not entry point
-        {
-          code: 'const x = 1; function handleClick() {} button;',
-        },
-        // Code with onClick handler but no frame-busting - now valid since not entry point
-        {
-          code: 'element.onClick = handler;',
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Unsafe iframe Usage', () => {
-    ruleTester.run('invalid - unsafe iframe sources', noClickjacking, {
-      valid: [],
-      invalid: [
-        // External HTTP source is untrusted
-        // missingFrameBusting only triggers for UI elements (button|input|form|a|div)
-        {
-          code: '<iframe src="http://external-site.com"></iframe>',
-          errors: [
-            {
-              messageId: 'unsafeIframeUsage',
-            },
-          ],
-        },
-        // HTTPS untrusted source
-        {
-          code: '<iframe src="https://untrusted.com/widget"></iframe>',
-          errors: [
-            {
-              messageId: 'unsafeIframeUsage',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Frame Manipulation', () => {
-    ruleTester.run('invalid - dangerous frame manipulation', noClickjacking, {
-      valid: [],
-      invalid: [
-        // Direct assignment to top.location
-        // missingFrameBusting only triggers for UI elements
-        {
-          code: 'top.location = "http://evil.com";',
-          errors: [
-            {
-              messageId: 'frameManipulation',
-            },
-          ],
-        },
-        // Assignment to window.location
-        {
-          code: 'window.location = "http://evil.com";',
-          errors: [
-            {
-              messageId: 'frameManipulation',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Transparent Overlays', () => {
-    ruleTester.run('invalid - transparent elements that could hide attacks', noClickjacking, {
-      valid: [],
-      invalid: [
-        // Literal must include 'style=' or 'css' to trigger
-        // missingFrameBusting only triggers for UI elements
-        {
-          code: 'const css = "style=opacity: 0; position: absolute; top: 0; left: 0;";',
-          errors: [
-            {
-              messageId: 'transparentFrameOverlay',
-            },
-          ],
-        },
-        // cssText with visibility hidden
-        {
-          code: 'element.cssText = "css visibility: hidden; z-index: -1;";',
-          errors: [
-            {
-              messageId: 'transparentFrameOverlay',
-            },
-          ],
-        },
-        // Template literal with 'style' keyword
-        {
-          code: 'const style = `style opacity: 0; position: absolute; top: 0; left: 0;`;',
-          errors: [
-            {
-              messageId: 'transparentFrameOverlay',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Valid Code - False Positives Reduced', () => {
-    ruleTester.run('valid - false positives reduced', noClickjacking, {
-      valid: [
-        // Trusted sources (starts with /)
-        {
-          code: '<iframe src="/local-content.html"></iframe>',
-        },
-        // Safe frame-busting comparison (doesn't assign)
-        {
-          code: 'if (top !== self) { console.log("framed"); }',
-        },
-        // String without 'style=' or 'css' doesn't trigger overlay check
-        {
-          code: 'const loadingStyle = "opacity: 0; transition: opacity 0.3s;";',
-        },
-        // Disabled frame-busting requirement
-        {
-          code: '<button onClick={handleClick}>Click me</button>',
-          options: [{ requireFrameBusting: false }],
-        },
-        // Code without UI elements
-        {
-          code: 'const data = 123;',
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Configuration Options', () => {
-    ruleTester.run('config - trusted sources', noClickjacking, {
-      valid: [
-        // Trusted source configured - no unsafeIframeUsage
-        // iframe alone doesn't trigger missingFrameBusting
-        {
-          code: '<iframe src="https://trusted.com"></iframe>',
-          options: [{ trustedSources: ['https://trusted.com'] }],
-        },
-      ],
-      invalid: [
-        // Untrusted source - only unsafeIframeUsage (no UI elements for missingFrameBusting)
-        {
-          code: '<iframe src="https://untrusted.com"></iframe>',
-          options: [{ trustedSources: ['https://trusted.com'] }],
-          errors: [
-            {
-              messageId: 'unsafeIframeUsage',
-            },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('config - disable frame-busting requirement', noClickjacking, {
-      valid: [
-        // With requireFrameBusting=false, UI elements don't trigger missingFrameBusting
-        {
-          code: '<form><input type="text" /><button>Submit</button></form>',
-          options: [{ requireFrameBusting: false }],
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Complex Clickjacking Scenarios', () => {
-    ruleTester.run('complex - real-world clickjacking attack patterns', noClickjacking, {
-      valid: [],
-      invalid: [
-        // Untrusted iframe source - only unsafeIframeUsage (iframe doesn't count as UI element)
-        {
-          code: '<iframe src="https://untrusted-social-widget.com/like" width="200" height="50" />',
-          errors: [
-            {
-              messageId: 'unsafeIframeUsage',
-            },
-          ],
-        },
-        // Frame manipulation attempt - only frameManipulation
-        {
-          code: 'window.location = "https://evil.com";',
-          errors: [
-            {
-              messageId: 'frameManipulation',
-            },
-          ],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-client-side-auth-logic/index.ts

@@ -1,81 +0,0 @@
-/**
- * @fileoverview Prevent authentication logic in client code
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noClientSideAuthLogic = createRule<RuleOptions, MessageIds>({
-  name: 'no-client-side-auth-logic',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent authentication logic in client code',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Client-Side Auth Logic',
-        cwe: 'CWE-602',
-        description: 'Authentication logic in client code - easily bypassed',
-        severity: 'CRITICAL',
-        fix: 'Move authentication checks to the server',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/602.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    const authKeywords = ['admin', 'authenticated', 'authorized', 'isAdmin', 'isAuthenticated', 'role'];
-    
-    return {
-      IfStatement(node: TSESTree.IfStatement) {
-        // Detect role/auth checks from localStorage
-        if (node.test.type === 'CallExpression' &&
-            node.test.callee.type === 'MemberExpression' &&
-            node.test.callee.object.type === 'Identifier' &&
-            node.test.callee.object.name === 'localStorage' &&
-            node.test.callee.property.type === 'Identifier' &&
-            node.test.callee.property.name === 'getItem') {
-          
-          const keyArg = node.test.arguments[0];
-          if (keyArg && keyArg.type === 'Literal') {
-            const key = String(keyArg.value).toLowerCase();
-            if (authKeywords.some(kw => key.includes(kw))) {
-              report(node);
-            }
-          }
-        }
-        
-        // Detect password comparison
-        if (node.test.type === 'BinaryExpression') {
-          const checkMember = (expr: TSESTree.Expression) => {
-            if (expr.type === 'MemberExpression' && 
-                expr.property.type === 'Identifier' &&
-                ['password', 'secret', 'token'].includes(expr.property.name)) {
-              return true;
-            }
-            return false;
-          };
-          
-          if (checkMember(node.test.left as TSESTree.Expression) || 
-              checkMember(node.test.right as TSESTree.Expression)) {
-            report(node);
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-client-side-auth-logic/no-client-side-auth-logic.test.ts

@@ -1,33 +0,0 @@
-/**
- * @fileoverview Tests for no-client-side-auth-logic
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noClientSideAuthLogic } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-client-side-auth-logic', noClientSideAuthLogic, {
-  valid: [
-    // Server-side auth checks
-    { code: "if (await verifyToken(token)) { proceed() }" },
-    { code: "const isAuth = await authService.verify()" },
-    // Non-auth localStorage usage
-    { code: "if (localStorage.getItem('theme')) { setTheme() }" },
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Local storage auth checks
-    { code: "if (localStorage.getItem('isAdmin')) { showAdmin() }", errors: [{ messageId: 'violationDetected' }] },
-    { code: "if (localStorage.getItem('authenticated')) { proceed() }", errors: [{ messageId: 'violationDetected' }] },
-    { code: "if (localStorage.getItem('role')) { checkRole() }", errors: [{ messageId: 'violationDetected' }] },
-    // Password comparison
-    { code: "if (user.password === input) { login() }", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/no-credentials-in-query-params/index.ts

@@ -1,69 +0,0 @@
-/**
- * @fileoverview Disallow credentials in URL query parameters
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/598.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noCredentialsInQueryParams = createRule<RuleOptions, MessageIds>({
-  name: 'no-credentials-in-query-params',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Disallow credentials in URL query parameters',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Credentials in Query Parameters',
-        cwe: 'CWE-798',
-        description: 'Credentials detected in URL query parameters - this is a security risk',
-        severity: 'CRITICAL',
-        fix: 'Use secure methods: POST body, headers (Authorization), or secure cookies',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/798.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    const sourceCode = context.sourceCode;
-    const sensitiveParams = ['password=', 'token=', 'apikey=', 'secret=', 'auth='];
-    
-    function report(node: TSESTree.Node) {
-      context.report({
-        node,
-        messageId: 'violationDetected',
-      });
-    }
-    
-    return {
-      Literal(node: TSESTree.Literal) {
-        if (typeof node.value === 'string') {
-          const url = node.value.toLowerCase();
-          
-          if (sensitiveParams.some(param => url.includes('?' + param) || url.includes('&' + param))) {
-            report(node);
-          }
-        }
-      },
-      
-      TemplateLiteral(node: TSESTree.TemplateLiteral) {
-        const text = sourceCode.getText(node).toLowerCase();
-        
-        if (sensitiveParams.some(param => text.includes(param))) {
-          report(node);
-        }
-      },
-    };
-  },
-});

package/src/rules/no-credentials-in-query-params/no-credentials-in-query-params.test.ts

@@ -1,33 +0,0 @@
-/**
- * @fileoverview Tests for no-credentials-in-query-params
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noCredentialsInQueryParams } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-credentials-in-query-params', noCredentialsInQueryParams, {
-  valid: [
-    // Safe URLs without credentials
-    { code: "const url = 'https://api.example.com/data'" },
-    { code: "const url = 'https://api.example.com?user=john'" },
-    { code: "fetch('https://api.example.com/users')" },
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // URLs with credentials in query params
-    { code: "const url = 'https://api.example.com?password=secret123'", errors: [{ messageId: 'violationDetected' }] },
-    { code: "const url = 'https://api.example.com?token=abc123'", errors: [{ messageId: 'violationDetected' }] },
-    { code: "fetch('https://api.example.com?apikey=xyz789')", errors: [{ messageId: 'violationDetected' }] },
-    { code: "const url = 'https://api.com?user=john&password=xyz'", errors: [{ messageId: 'violationDetected' }] },
-    // Template literals with credentials
-    { code: "const url = `https://api.com?token=${token}`", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/no-credentials-in-storage-api/index.ts

@@ -1,64 +0,0 @@
-/**
- * @fileoverview Disallow storing credentials in browser/mobile storage APIs
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noCredentialsInStorageApi = createRule<RuleOptions, MessageIds>({
-  name: 'no-credentials-in-storage-api',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Disallow storing credentials in browser/mobile storage APIs',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Credentials in Storage',
-        cwe: 'CWE-522',
-        description: 'Credentials stored in insecure browser/mobile storage',
-        severity: 'CRITICAL',
-        fix: 'Use secure storage like Keychain, SecureStore, or encrypted storage',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/522.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    const sensitiveKeys = ['password', 'token', 'apikey', 'secret', 'credential', 'auth', 'key'];
-    const storageObjects = ['localStorage', 'sessionStorage', 'AsyncStorage'];
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Check localStorage.setItem/sessionStorage.setItem/AsyncStorage.setItem
-        if (node.callee.type === 'MemberExpression' &&
-            node.callee.object.type === 'Identifier' &&
-            storageObjects.includes(node.callee.object.name) &&
-            node.callee.property.type === 'Identifier' &&
-            node.callee.property.name === 'setItem') {
-          
-          const keyArg = node.arguments[0];
-          if (keyArg && keyArg.type === 'Literal' && typeof keyArg.value === 'string') {
-            const key = keyArg.value.toLowerCase();
-            if (sensitiveKeys.some(k => key.includes(k))) {
-              report(node);
-            }
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-credentials-in-storage-api/no-credentials-in-storage-api.test.ts

@@ -1,31 +0,0 @@
-/**
- * @fileoverview Tests for no-credentials-in-storage-api
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noCredentialsInStorageApi } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-credentials-in-storage-api', noCredentialsInStorageApi, {
-  valid: [
-    // Safe storage usage
-    { code: "localStorage.setItem('theme', 'dark')" },
-    { code: "sessionStorage.setItem('language', 'en')" },
-    { code: "AsyncStorage.setItem('settings', json)" },
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Storing credentials
-    { code: "localStorage.setItem('password', pwd)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "localStorage.setItem('authToken', token)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "sessionStorage.setItem('apiKey', key)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "AsyncStorage.setItem('secret', data)", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/no-data-in-temp-storage/index.ts

@@ -1,75 +0,0 @@
-/**
- * @fileoverview Prevent sensitive data in temp directories
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noDataInTempStorage = createRule<RuleOptions, MessageIds>({
-  name: 'no-data-in-temp-storage',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent sensitive data in temp directories',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Temp Storage Data',
-        cwe: 'CWE-312',
-        description: 'Sensitive data written to temp directory - not secure',
-        severity: 'HIGH',
-        fix: 'Use secure storage location or encrypt data before writing',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/312.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    const tempPaths = ['/tmp', '/var/tmp', 'temp/', '/temp'];
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Detect fs.writeFileSync or fs.writeFile with temp path
-        if (node.callee.type === 'MemberExpression' &&
-            node.callee.object.type === 'Identifier' &&
-            node.callee.object.name === 'fs' &&
-            node.callee.property.type === 'Identifier' &&
-            ['writeFileSync', 'writeFile'].includes(node.callee.property.name)) {
-          
-          const pathArg = node.arguments[0];
-          if (pathArg && pathArg.type === 'Literal' && typeof pathArg.value === 'string') {
-            if (tempPaths.some(tp => pathArg.value.includes(tp))) {
-              report(node);
-            }
-          }
-        }
-      },
-      
-      Literal(node: TSESTree.Literal) {
-        // Detect temp path literals
-        if (typeof node.value === 'string') {
-          if (tempPaths.some(tp => node.value.includes(tp))) {
-            // Only flag if parent is assignment or variable declaration
-            const parent = node.parent;
-            if (parent?.type === 'VariableDeclarator' || parent?.type === 'AssignmentExpression') {
-              report(node);
-            }
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-data-in-temp-storage/no-data-in-temp-storage.test.ts

@@ -1,33 +0,0 @@
-/**
- * @fileoverview Tests for no-data-in-temp-storage
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noDataInTempStorage } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-data-in-temp-storage', noDataInTempStorage, {
-  valid: [
-    // Secure storage locations
-    { code: "fs.writeFileSync('/app/data/file.txt', data)" },
-    { code: "fs.writeFile('/secure/path/file.json', data, callback)" },
-    // Non-path literals
-    { code: "console.log('temp data')" },
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Temp path writes
-    { code: "fs.writeFileSync('/tmp/secrets.json', data)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "fs.writeFile('/var/tmp/auth.txt', data, cb)", errors: [{ messageId: 'violationDetected' }] },
-    // Temp path variables
-    { code: "const path = '/tmp/sensitive.txt'", errors: [{ messageId: 'violationDetected' }] },
-    { code: "let file = '/var/tmp/data.json'", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});