eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-document-cookie/no-document-cookie.test.ts

@@ -1,382 +0,0 @@
-/**
- * Comprehensive tests for no-document-cookie rule
- * Prevent direct usage of document.cookie
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noDocumentCookie } from './index';
-
-// Configure RuleTester for Vitest
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-// Use Flat Config format (ESLint 9+)
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-document-cookie', () => {
-  describe('basic functionality', () => {
-    ruleTester.run('prevent document.cookie usage', noDocumentCookie, {
-      valid: [
-        // Other document properties
-        {
-          code: 'document.title = "New Title";',
-        },
-        {
-          code: 'const url = document.URL;',
-        },
-        {
-          code: 'document.body.appendChild(element);',
-        },
-        // Other objects with cookie property
-        {
-          code: 'response.cookie = "value";',
-        },
-        {
-          code: 'const cookie = req.cookies;',
-        },
-        // Cookie Store API usage (recommended)
-        {
-          code: 'await cookieStore.set("name", "value");',
-        },
-        {
-          code: 'const cookies = await cookieStore.getAll();',
-        },
-        // Cookie libraries
-        {
-          code: 'Cookies.set("name", "value");',
-        },
-        {
-          code: 'const value = Cookies.get("name");',
-        },
-        // Reading document.cookie (allowed by default)
-        {
-          code: 'const cookies = document.cookie;',
-        },
-        {
-          code: 'console.log(document.cookie);',
-        },
-        {
-          code: 'const parsed = document.cookie.split("; ");',
-        },
-      ],
-      invalid: [
-        // Direct assignment
-        {
-          code: 'document.cookie = "name=value";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Compound assignment
-        {
-          code: 'document.cookie += "; name=value";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('allowReading option', () => {
-    ruleTester.run('allowReading option', noDocumentCookie, {
-      valid: [
-        // Reading is allowed by default
-        {
-          code: 'const cookies = document.cookie;',
-          options: [{ allowReading: true }],
-        },
-        {
-          code: 'console.log(document.cookie);',
-          options: [{ allowReading: true }],
-        },
-        {
-          code: 'const parsed = document.cookie.split("; ");',
-          options: [{ allowReading: true }],
-        },
-      ],
-      invalid: [
-        // Assignments are still flagged
-        {
-          code: 'document.cookie = "name=value";',
-          options: [{ allowReading: true }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Reading is not allowed when disabled
-        {
-          code: 'const cookies = document.cookie;',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('complex expressions', () => {
-    ruleTester.run('complex expressions', noDocumentCookie, {
-      valid: [],
-      invalid: [
-        // In function calls
-        {
-          code: 'setCookie(document.cookie);',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In ternary expressions
-        {
-          code: 'const value = condition ? document.cookie : "default";',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In template literals
-        {
-          code: 'console.log(`Cookies: ${document.cookie}`);',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Chained method calls
-        {
-          code: 'document.cookie.split(";").forEach(cookie => console.log(cookie));',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Optional chaining
-        {
-          code: 'const cookies = document?.cookie;',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('different contexts', () => {
-    ruleTester.run('different code contexts', noDocumentCookie, {
-      valid: [],
-      invalid: [
-        // In function
-        {
-          code: `
-            function getCookies() {
-              return document.cookie;
-            }
-          `,
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In class method
-        {
-          code: `
-            class CookieManager {
-              getAll() {
-                document.cookie = "test=value";
-                return document.cookie;
-              }
-            }
-          `,
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In arrow function
-        {
-          code: 'const getCookie = () => document.cookie;',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In async function
-        {
-          code: `
-            async function setCookie(name, value) {
-              document.cookie = \`\${name}=\${value}\`;
-            }
-          `,
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // In conditional
-        {
-          code: `
-            if (typeof document !== 'undefined') {
-              document.cookie += "; path=/";
-            }
-          `,
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('edge cases', () => {
-    ruleTester.run('edge cases', noDocumentCookie, {
-      valid: [
-        // Shadowed document variable
-        {
-          code: `
-            const document = { cookie: "fake" };
-            console.log(document.cookie);
-          `,
-        },
-        // Different property names
-        {
-          code: 'document.cookies = "value";',
-        },
-        {
-          code: 'const value = document.cookieValue;',
-        },
-      ],
-      invalid: [
-        // Computed property access
-        {
-          code: 'document["cookie"] = "value";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Variable assignment
-        {
-          code: 'let cookie = document.cookie;',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Const assignment
-        {
-          code: 'const cookieString = document.cookie;',
-          options: [{ allowReading: false }],
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-
-  describe('assignment detection', () => {
-    ruleTester.run('assignment detection', noDocumentCookie, {
-      valid: [],
-      invalid: [
-        // Direct assignment
-        {
-          code: 'document.cookie = "session=abc123";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Assignment with path
-        {
-          code: 'document.cookie = "name=value; path=/";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Compound assignment
-        {
-          code: 'document.cookie += "; secure";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Assignment with expiration
-        {
-          code: 'document.cookie = "user=john; expires=Fri, 31 Dec 9999 23:59:59 GMT";',
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-        // Multiple assignments
-        {
-          code: `
-            document.cookie = "first=value1";
-            document.cookie = "second=value2";
-          `,
-          errors: [
-            {
-              messageId: 'noDocumentCookie',
-            },
-            {
-              messageId: 'noDocumentCookie',
-            },
-          ],
-        },
-      ],
-    });
-  });
-});

package/src/rules/no-dynamic-dependency-loading/index.ts

@@ -1,60 +0,0 @@
-/**
- * @fileoverview Prevent dynamic dependency injection
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/494.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noDynamicDependencyLoading = createRule<RuleOptions, MessageIds>({
-  name: 'no-dynamic-dependency-loading',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent runtime dependency injection with dynamic paths',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M2'],
-      cweIds: ['CWE-494'],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-1104',
-        description: 'Dynamic import/require detected - use static imports for security',
-        severity: 'HIGH',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/1104.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Dynamic require
-        if (node.callee.name === 'require' && node.arguments[0]?.type !== 'Literal') {
-          context.report({ node, messageId: 'violationDetected' });
-        }
-      },
-      
-      ImportExpression(node: TSESTree.ImportExpression) {
-        // Dynamic import()
-        if (node.source.type !== 'Literal') {
-          context.report({ node, messageId: 'violationDetected' });
-        }
-      },
-   };
-  },
-});
-

package/src/rules/no-dynamic-dependency-loading/no-dynamic-dependency-loading.test.ts

@@ -1,27 +0,0 @@
-/**
- * @fileoverview Tests for no-dynamic-dependency-loading
- * 
- * Coverage: Comprehensive test suite with valid and invalid cases
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noDynamicDependencyLoading } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-dynamic-dependency-loading', noDynamicDependencyLoading, {
-  valid: [
-    { code: "import module from './module'" },
-    { code: "const lib = require('known-lib')" }
-  ],
-
-  invalid: [
-    { code: "require(moduleName)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "import(userInput)", errors: [{ messageId: 'violationDetected' }] }
-  ],
-});