eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-directive-injection/no-directive-injection.test.ts

@@ -1,305 +0,0 @@
-/**
- * Comprehensive tests for no-directive-injection rule
- * Security: CWE-96 (Improper Neutralization of Directives in Statically Saved Code)
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noDirectiveInjection } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-// Use Flat Config format (ESLint 9+) with JSX support
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-    parserOptions: {
-      ecmaFeatures: {
-        jsx: true,
-      },
-    },
-  },
-});
-
-describe('no-directive-injection', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - safe directive usage', noDirectiveInjection, {
-      valid: [
-        // Safe innerHTML with text content (not innerHTML)
-        {
-          code: 'element.textContent = userInput;',
-        },
-        // Trusted directive names (string literal, not user input)
-        {
-          code: 'Vue.directive("my-directive", { /* safe */ });',
-        },
-        // Static HTML (no user input variables)
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: "static content" }} />',
-        },
-        // innerHTML with non-user input
-        {
-          code: 'element.innerHTML = staticContent;',
-        },
-        // Handlebars compile with non-user input
-        {
-          code: 'const compiled = Handlebars.compile(staticTemplate);',
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - dangerouslySetInnerHTML', () => {
-    ruleTester.run('invalid - dangerous innerHTML usage', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // userInput is a recognized user input variable
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: userInput }} />',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-          ],
-        },
-        // req.body.content contains 'body' which is a user input variable
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: req.body.content }} />',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Template Injection', () => {
-    ruleTester.run('invalid - template injection in JSX', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // Template literal with userInput in dangerouslySetInnerHTML
-        // Only triggers dangerousInnerHTML (JSX context doesn't trigger templateInjection via TemplateLiteral visitor)
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: `Hello ${userInput}!` }} />',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-            {
-              messageId: 'templateInjection',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - innerHTML Assignments', () => {
-    ruleTester.run('invalid - unsafe innerHTML assignments', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        {
-          code: 'element.innerHTML = userInput;',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-          ],
-        },
-        {
-          code: 'document.getElementById("content").innerHTML = req.body.html;',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Dynamic Component Binding', () => {
-    ruleTester.run('invalid - unsafe component binding', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // JSX is={userInput} - userInput is in user input variables
-        // Rule only detects Identifiers (not MemberExpressions like req.query.x)
-        {
-          code: '<div is={userInput}></div>',
-          errors: [
-            {
-              messageId: 'unsafeComponentBinding',
-            },
-          ],
-        },
-        // data is in user input variables
-        {
-          code: '<div is={data}></div>',
-          errors: [
-            {
-              messageId: 'unsafeComponentBinding',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Template Compilation', () => {
-    ruleTester.run('invalid - unsafe template compilation', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // Handlebars.compile with userInput variable
-        {
-          code: 'const compiled = Handlebars.compile(userInput);',
-          errors: [
-            {
-              messageId: 'userControlledTemplate',
-            },
-          ],
-        },
-        // _.template with variable containing "input"
-        {
-          code: 'const template = _.template(userInput);',
-          errors: [
-            {
-              messageId: 'userControlledTemplate',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Dynamic Directive Creation', () => {
-    ruleTester.run('invalid - dynamic directive creation', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // Vue.directive with userInput as directive name
-        {
-          code: 'Vue.directive(userInput, directiveDefinition);',
-          errors: [
-            {
-              messageId: 'unsafeDirectiveName',
-            },
-          ],
-        },
-        // directive() with userInput as directive name
-        {
-          code: 'directive(userInput, function() { /* ... */ });',
-          errors: [
-            {
-              messageId: 'dynamicDirectiveCreation',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Valid Code - False Positives Reduced', () => {
-    ruleTester.run('valid - false positives reduced', noDirectiveInjection, {
-      valid: [
-        // safeHtml is not a user input variable, so it's valid
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: safeHtml }} />',
-        },
-        // safeTemplate doesn't contain user input variable names
-        {
-          code: 'const compiled = Handlebars.compile(safeTemplate);',
-        },
-        // Trusted directive names (string literal)
-        {
-          code: 'Vue.directive("my-safe-directive", definition);',
-        },
-        // Static HTML string doesn't trigger
-        {
-          code: 'element.innerHTML = "<strong>Safe</strong>";',
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Configuration Options', () => {
-    ruleTester.run('config - user input variables', noDirectiveInjection, {
-      valid: [
-        // customVar is not in default user input variables
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: customVar }} />',
-        },
-      ],
-      invalid: [
-        // requestData contains 'request' which is in user input variables
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: requestData }} />',
-          errors: [
-            {
-              messageId: 'dangerousInnerHTML',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('Complex Directive Injection Scenarios', () => {
-    ruleTester.run('complex - real-world directive injection attacks', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // innerHTML assignment with template literal containing user input
-        {
-          code: 'element.innerHTML = `<div>${userInput}</div>`;',
-          errors: [
-            { messageId: 'dangerousInnerHTML' },
-            { messageId: 'templateInjection' },
-          ],
-        },
-        // Dangerous template literal inside dangerouslySetInnerHTML (Now properly detected by fix)
-        {
-          code: '<div dangerouslySetInnerHTML={{ __html: `Hello ${userInput}!` }} />',
-          errors: [
-            { messageId: 'dangerousInnerHTML' },
-            { messageId: 'templateInjection' },
-          ],
-        },
-        // Multiple dangerous patterns
-        {
-          code: `
-            element.innerHTML = req.body.html;
-            const tpl = Handlebars.compile(userInput);
-          `,
-          errors: [
-            { messageId: 'dangerousInnerHTML' },
-            { messageId: 'userControlledTemplate' },
-          ],
-        },
-      ],
-    });
-
-    ruleTester.run('invalid - namespaced attributes', noDirectiveInjection, {
-      valid: [],
-      invalid: [
-        // v:bind with user input
-        {
-          code: '<div v:bind={userInput}></div>',
-          errors: [{ messageId: 'directiveInjection' }],
-        },
-        // ng:model with user input
-        {
-          code: '<input ng:model={userInput} />',
-          errors: [{ messageId: 'directiveInjection' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-disabled-certificate-validation/index.ts

@@ -1,72 +0,0 @@
-/**
- * @fileoverview Prevent disabled SSL/TLS certificate validation
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noDisabledCertificateValidation = createRule<RuleOptions, MessageIds>({
-  name: 'no-disabled-certificate-validation',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent disabled SSL/TLS certificate validation',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Disabled Certificate Validation',
-        cwe: 'CWE-295',
-        description: 'SSL/TLS certificate validation is disabled - man-in-the-middle attack possible',
-        severity: 'CRITICAL',
-        fix: 'Remove rejectUnauthorized: false or verify: false, fix certificate issues properly',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/295.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    const dangerousProperties = ['rejectUnauthorized', 'strictSSL', 'verify'];
-    
-    return {
-      Property(node: TSESTree.Property) {
-        // Check for dangerous SSL options set to false
-        if (node.key.type === 'Identifier' && 
-            dangerousProperties.includes(node.key.name) &&
-            node.value.type === 'Literal' && 
-            node.value.value === false) {
-          report(node);
-        }
-      },
-      
-      AssignmentExpression(node: TSESTree.AssignmentExpression) {
-        // Check for NODE_TLS_REJECT_UNAUTHORIZED = '0'
-        if (node.left.type === 'MemberExpression' &&
-            node.left.object.type === 'MemberExpression' &&
-            node.left.object.object.type === 'Identifier' &&
-            node.left.object.object.name === 'process' &&
-            node.left.object.property.type === 'Identifier' &&
-            node.left.object.property.name === 'env' &&
-            node.left.property.type === 'Identifier' &&
-            node.left.property.name === 'NODE_TLS_REJECT_UNAUTHORIZED') {
-          
-          if (node.right.type === 'Literal' && node.right.value === '0') {
-            report(node);
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-disabled-certificate-validation/no-disabled-certificate-validation.test.ts

@@ -1,33 +0,0 @@
-/**
- * @fileoverview Tests for no-disabled-certificate-validation
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noDisabledCertificateValidation } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-disabled-certificate-validation', noDisabledCertificateValidation, {
-  valid: [
-    // Proper SSL configuration
-    { code: "const options = { rejectUnauthorized: true }" },
-    { code: "const config = { strictSSL: true }" },
-    { code: "const settings = { verify: true }" },
-    // Non-SSL code
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Disabled certificate validation
-    { code: "const options = { rejectUnauthorized: false }", errors: [{ messageId: 'violationDetected' }] },
-    { code: "https.request({ strictSSL: false })", errors: [{ messageId: 'violationDetected' }] },
-    { code: "const config = { verify: false }", errors: [{ messageId: 'violationDetected' }] },
-    // Environment variable disable
-    { code: "process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/no-document-cookie/index.ts

@@ -1,113 +0,0 @@
-/**
- * ESLint Rule: no-document-cookie
- * Prevent direct usage of document.cookie
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule } from '@interlace/eslint-devkit';
-import { formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-
-type MessageIds = 'noDocumentCookie';
-
-export interface Options {
-  /** Allow reading document.cookie for parsing */
-  allowReading?: boolean;
-}
-
-type RuleOptions = [Options?];
-
-export const noDocumentCookie = createRule<RuleOptions, MessageIds>({
-  name: 'no-document-cookie',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent direct usage of document.cookie - use Cookie Store API or cookie libraries instead',
-    },
-    hasSuggestions: false,
-    messages: {
-      noDocumentCookie: formatLLMMessage({
-        icon: MessageIcons.WARNING,
-        issueName: 'Document Cookie',
-        description: 'Avoid direct document.cookie usage',
-        severity: 'MEDIUM',
-        fix: 'Use Cookie Store API or cookie library instead',
-        documentationLink: 'https://github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/no-document-cookie.md',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          allowReading: {
-            type: 'boolean',
-            default: true,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [{ allowReading: true }],
-
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const [options] = context.options;
-    const { allowReading = true } = options || {};
-
-    function isDocumentCookieAccess(node: TSESTree.MemberExpression): boolean {
-      // Check if this is accessing document.cookie
-      return (
-        node.object.type === 'Identifier' &&
-        node.object.name === 'document' &&
-        ((node.property.type === 'Identifier' && node.property.name === 'cookie') ||
-         (node.computed && node.property.type === 'Literal' && node.property.value === 'cookie'))
-      );
-    }
-
-    function isAssignmentToCookie(node: TSESTree.MemberExpression): boolean {
-      // Check if this is an assignment to document.cookie
-      const parent = node.parent;
-
-      // Check direct assignment
-      if (parent?.type === 'AssignmentExpression' && parent.left === node) {
-        return true;
-      }
-
-      // Check compound assignment (+=, -=, etc.)
-      if (parent?.type === 'AssignmentExpression' &&
-          parent.operator &&
-          parent.operator.includes('=') &&
-          parent.left === node) {
-        return true;
-      }
-
-      // Variable declarator (const/let/var x = document.cookie) - this is reading, not assigning
-      if (parent?.type === 'VariableDeclarator' && parent.init === node) {
-        return false;
-      }
-
-      return false;
-    }
-
-    return {
-      MemberExpression(node: TSESTree.MemberExpression) {
-        if (isDocumentCookieAccess(node)) {
-          const isAssigning = isAssignmentToCookie(node);
-
-          // If allowReading is true, only flag assignments
-          // If allowReading is false, flag everything
-          if (allowReading && !isAssigning) {
-            return; // Allow reading when option is enabled
-          }
-
-          // Flag document.cookie usage
-          context.report({
-            node,
-            messageId: 'noDocumentCookie',
-            data: {
-              operation: isAssigning ? 'assignment to' : 'reading from',
-            },
-          });
-        }
-      },
-    };
-  },
-});