eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-sensitive-data-exposure/index.ts

@@ -1,294 +0,0 @@
-/**
- * ESLint Rule: no-sensitive-data-exposure
- * Detects PII/credentials in logs, responses, or error messages
- * Priority 5: Security with Data Flow Analysis
- * CWE-532: Information Exposure Through Log Files
- * 
- * @see https://cwe.mitre.org/data/definitions/532.html
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import { createRule } from '@interlace/eslint-devkit';
-
-type MessageIds =
-  | 'sensitiveDataExposure'
-  | 'redactData'
-  | 'useMasking'
-  | 'removeFromLogs';
-
-export interface Options {
-  /** Sensitive data patterns. Default: ['password', 'secret', 'token', 'key', 'ssn', 'credit', 'card'] */
-  sensitivePatterns?: string[];
-  
-  /** Check console.log statements. Default: true */
-  checkConsoleLog?: boolean;
-  
-  /** Check error messages. Default: true */
-  checkErrorMessages?: boolean;
-  
-  /** Check API responses. Default: true */
-  checkApiResponses?: boolean;
-}
-
-type RuleOptions = [Options?];
-
-/**
- * Check if string contains sensitive data patterns
- */
-function containsSensitiveData(
-  text: string,
-  patterns: string[]
-): boolean {
-  const lowerText = text.toLowerCase();
-  return patterns.some(pattern => lowerText.includes(pattern.toLowerCase()));
-}
-
-
-export const noSensitiveDataExposure = createRule<RuleOptions, MessageIds>({
-  name: 'no-sensitive-data-exposure',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Detects PII/credentials in logs, responses, or error messages',
-    },
-    hasSuggestions: true,
-    messages: {
-      sensitiveDataExposure: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Sensitive data exposure',
-        cwe: 'CWE-532',
-        description: 'Sensitive data detected in {{context}}: {{dataType}}',
-        severity: 'HIGH',
-        fix: 'Redact or mask sensitive data before logging/exposing',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/532.html',
-      }),
-      redactData: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Redact Data',
-        description: 'Redact sensitive data before logging',
-        severity: 'LOW',
-        fix: 'Redact sensitive fields before logging',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/532.html',
-      }),
-      useMasking: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Masking',
-        description: 'Use data masking function',
-        severity: 'LOW',
-        fix: 'maskSensitive(data)',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/532.html',
-      }),
-      removeFromLogs: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Remove From Logs',
-        description: 'Remove sensitive data from logs and errors',
-        severity: 'LOW',
-        fix: 'Filter sensitive data before logging',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/532.html',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          sensitivePatterns: {
-            type: 'array',
-            items: { type: 'string' },
-            default: ['password', 'secret', 'token', 'key', 'ssn', 'credit', 'card', 'api_key', 'apikey'],
-            description: 'Sensitive data patterns',
-          },
-          checkConsoleLog: {
-            type: 'boolean',
-            default: true,
-            description: 'Check console.log statements',
-          },
-          checkErrorMessages: {
-            type: 'boolean',
-            default: true,
-            description: 'Check error messages',
-          },
-          checkApiResponses: {
-            type: 'boolean',
-            default: true,
-            description: 'Check API responses',
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      sensitivePatterns: ['password', 'secret', 'token', 'key', 'ssn', 'credit', 'card', 'api_key', 'apikey'],
-      checkConsoleLog: true,
-      checkErrorMessages: true,
-      checkApiResponses: true,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>, [options = {}]) {
-    const {
-sensitivePatterns = ['password', 'secret', 'token', 'key', 'ssn', 'credit', 'card', 'api_key', 'apikey'],
-      checkConsoleLog = true,
-      checkErrorMessages = true,
-    
-}: Options = options || {};
-
-    /**
-     * Check CallExpression for logging calls with sensitive data
-     */
-    function checkCallExpression(node: TSESTree.CallExpression) {
-      // Check if it's a logging call (console.*, logger.*)
-      const isLoggingCall = (() => {
-        if (node.callee.type === 'MemberExpression') {
-          const object = node.callee.object;
-          const property = node.callee.property;
-          if (property.type === 'Identifier') {
-            const methodName = property.name.toLowerCase();
-            if (['log', 'info', 'warn', 'error', 'debug', 'trace'].includes(methodName)) {
-              // Check if it's console.* or logger.*
-              if (object.type === 'Identifier') {
-                const objName = object.name.toLowerCase();
-                if (objName === 'console' || objName === 'logger') {
-                  return true;
-                }
-              }
-            }
-          }
-        } else if (node.callee.type === 'Identifier') {
-          // Check for logger.info() pattern
-          const calleeName = node.callee.name.toLowerCase();
-          if (calleeName.includes('log') || calleeName.includes('logger')) {
-            return true;
-          }
-        }
-        return false;
-      })();
-
-      if (isLoggingCall && checkConsoleLog) {
-
-        // Check if any argument contains sensitive data
-        for (const arg of node.arguments) {
-          if (arg.type === 'Literal' && typeof arg.value === 'string') {
-            const text = arg.value;
-            if (containsSensitiveData(text, sensitivePatterns)) {
-              context.report({
-                node: arg,
-                messageId: 'sensitiveDataExposure',
-                data: {
-                  context: 'logs',
-                  dataType: 'password',
-                },
-                suggest: [
-                  { messageId: 'redactData', fix: () => null },
-                  { messageId: 'useMasking', fix: () => null },
-                  { messageId: 'removeFromLogs', fix: () => null },
-                ],
-              });
-              return; // Only report once per call
-            }
-          } else if (arg.type === 'Identifier' && arg.name) {
-            const name = arg.name.toLowerCase();
-            if (containsSensitiveData(name, sensitivePatterns)) {
-              context.report({
-                node: arg,
-                messageId: 'sensitiveDataExposure',
-                data: {
-                  context: 'logs',
-                  dataType: 'password',
-                },
-                suggest: [
-                  { messageId: 'redactData', fix: () => null },
-                  { messageId: 'useMasking', fix: () => null },
-                  { messageId: 'removeFromLogs', fix: () => null },
-                ],
-              });
-              return; // Only report once per call
-            }
-          }
-        }
-      }
-    }
-    
-    /**
-     * Check NewExpression for Error with sensitive data
-     */
-    function checkNewExpression(node: TSESTree.NewExpression) {
-      if (!checkErrorMessages) {
-        return;
-      }
-
-      if (node.callee && node.callee.type === 'Identifier' && node.callee.name === 'Error') {
-        // Check all arguments for sensitive data (report only once per error)
-        for (const arg of node.arguments) {
-          if (arg.type === 'Literal' && typeof arg.value === 'string') {
-            const text = arg.value;
-            if (containsSensitiveData(text, sensitivePatterns)) {
-              context.report({
-                node: arg,
-                messageId: 'sensitiveDataExposure',
-                data: {
-                  context: 'error messages',
-                  dataType: 'password',
-                },
-                suggest: [
-                  { messageId: 'redactData', fix: () => null },
-                  { messageId: 'useMasking', fix: () => null },
-                  { messageId: 'removeFromLogs', fix: () => null },
-                ],
-              });
-              return; // Only report once per error
-            }
-          } else if (arg.type === 'BinaryExpression' && arg.operator === '+') {
-            // Check left side if it's a literal
-            if (arg.left && arg.left.type === 'Literal' && typeof arg.left.value === 'string') {
-              const leftText = arg.left.value;
-              if (containsSensitiveData(leftText, sensitivePatterns)) {
-                context.report({
-                  node: arg.left,
-                  messageId: 'sensitiveDataExposure',
-                  data: {
-                    context: 'error messages',
-                    dataType: 'password',
-                  },
-                  suggest: [
-                    { messageId: 'redactData', fix: () => null },
-                    { messageId: 'useMasking', fix: () => null },
-                    { messageId: 'removeFromLogs', fix: () => null },
-                  ],
-                });
-                return; // Only report once per error
-              }
-            }
-            // Check right side if it's an identifier
-            if (arg.right && arg.right.type === 'Identifier' && arg.right.name) {
-              const rightName = arg.right.name.toLowerCase();
-              if (containsSensitiveData(rightName, sensitivePatterns)) {
-                context.report({
-                  node: arg.right,
-                  messageId: 'sensitiveDataExposure',
-                  data: {
-                    context: 'error messages',
-                    dataType: 'password',
-                  },
-                  suggest: [
-                    { messageId: 'redactData', fix: () => null },
-                    { messageId: 'useMasking', fix: () => null },
-                    { messageId: 'removeFromLogs', fix: () => null },
-                  ],
-                });
-                return; // Only report once per error
-              }
-            }
-          }
-        }
-      }
-    }
-
-    return {
-      CallExpression: checkCallExpression,
-      NewExpression: checkNewExpression,
-    };
-  },
-});
-
-

package/src/rules/no-sensitive-data-exposure/no-sensitive-data-exposure.test.ts

@@ -1,262 +0,0 @@
-/**
- * Comprehensive tests for no-sensitive-data-exposure rule
- * Security: Detects PII/credentials in logs, responses, or error messages
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { noSensitiveDataExposure } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('no-sensitive-data-exposure', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - no sensitive data', noSensitiveDataExposure, {
-      valid: [
-        // Regular log messages
-        {
-          code: `console.log('User logged in');`,
-        },
-        {
-          code: `console.log('Hello world');`,
-        },
-        // Logger methods without sensitive data
-        {
-          code: `logger.info('Request received');`,
-        },
-        {
-          code: `logger.error('Operation failed');`,
-        },
-        {
-          code: `logger.debug('Processing started');`,
-        },
-        // Errors without sensitive data
-        {
-          code: `throw new Error('Operation failed');`,
-        },
-        {
-          code: `new Error('Invalid input');`,
-        },
-        // Variables with sensitive names not in logs
-        {
-          code: `const password = process.env.PASSWORD;`,
-        },
-        // Non-logging function calls with sensitive data (not flagged)
-        {
-          code: `processData('password value');`,
-        },
-        {
-          code: `fetch('https://api.example.com?token=abc');`,
-        },
-        // Member expression that's not console/logger
-        {
-          code: `validator.check('password field');`,
-        },
-        // Custom patterns - not matching
-        {
-          code: `console.log('Password:', password);`,
-          options: [{ sensitivePatterns: ['secret'] }],
-        },
-        // Disabled checks
-        {
-          code: `console.log('password is:', pwd);`,
-          options: [{ checkConsoleLog: false }],
-        },
-        {
-          code: `throw new Error('password error');`,
-          options: [{ checkErrorMessages: false }],
-        },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code - Console Log', () => {
-    ruleTester.run('invalid - console.log with sensitive data', noSensitiveDataExposure, {
-      valid: [],
-      invalid: [
-        // String literal with password
-        {
-          code: `console.log('password: 123456');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with token
-        {
-          code: `console.log('API token: abc123');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with key
-        {
-          code: `console.log('secret key value');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with SSN
-        {
-          code: `console.log('SSN: 123-45-6789');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with credit
-        {
-          code: `console.log('credit card number');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // Identifier with password in name
-        {
-          code: `console.log(userPassword);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // Identifier with token in name
-        {
-          code: `console.log(apiToken);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // Identifier with key in name
-        {
-          code: `console.log(secretKey);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Logger Methods', () => {
-    ruleTester.run('invalid - logger with sensitive data', noSensitiveDataExposure, {
-      valid: [],
-      invalid: [
-        // logger.info
-        {
-          code: `logger.info('password exposed');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // logger.warn
-        {
-          code: `logger.warn('api_key: xyz');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // logger.error
-        {
-          code: `logger.error('token invalid');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // logger.debug with identifier
-        {
-          code: `logger.debug(password);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // console.warn
-        {
-          code: `console.warn('secret exposed');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // console.error
-        {
-          code: `console.error('apikey error');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // console.debug
-        {
-          code: `console.debug(apiKey);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // console.trace
-        {
-          code: `console.trace('token trace');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Identifier-based Logging', () => {
-    ruleTester.run('invalid - log() function with sensitive data', noSensitiveDataExposure, {
-      valid: [],
-      invalid: [
-        // Direct log() function call
-        {
-          code: `log('password: 123');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // customLogger() function
-        {
-          code: `customLogger('token exposed');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-      ],
-    });
-  });
-
-  describe('Invalid Code - Error Messages', () => {
-    ruleTester.run('invalid - Error with sensitive data', noSensitiveDataExposure, {
-      valid: [],
-      invalid: [
-        // String literal with password
-        {
-          code: `throw new Error('password is invalid');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with token
-        {
-          code: `new Error('token expired');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // String literal with secret
-        {
-          code: `throw new Error('secret not found');`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // BinaryExpression with sensitive left side
-        {
-          code: `throw new Error('password: ' + value);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // BinaryExpression with sensitive right identifier
-        {
-          code: `throw new Error('Error: ' + userPassword);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // BinaryExpression with token identifier
-        {
-          code: `throw new Error('Invalid ' + apiToken);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // BinaryExpression with key identifier
-        {
-          code: `throw new Error('Missing ' + secretKey);`,
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-      ],
-    });
-  });
-
-  describe('Options - Custom Patterns', () => {
-    ruleTester.run('options - custom sensitive patterns', noSensitiveDataExposure, {
-      valid: [],
-      invalid: [
-        // Custom pattern: email
-        {
-          code: `console.log('user email: test@example.com');`,
-          options: [{ sensitivePatterns: ['email'] }],
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-        // Custom pattern: phone
-        {
-          code: `logger.info('phone number logged');`,
-          options: [{ sensitivePatterns: ['phone'] }],
-          errors: [{ messageId: 'sensitiveDataExposure' }],
-        },
-      ],
-    });
-  });
-});
-

package/src/rules/no-sensitive-data-in-analytics/index.ts

@@ -1,73 +0,0 @@
-/**
- * @fileoverview Prevent PII sent to analytics
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/359.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noSensitiveDataInAnalytics = createRule<RuleOptions, MessageIds>({
-  name: 'no-sensitive-data-in-analytics',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent PII being sent to analytics services',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M6'],
-      cweIds: ['CWE-359'],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Sensitive Data in Analytics',
-        cwe: 'CWE-359',
-        description: 'Sensitive field sent to analytics - this is a privacy violation',
-        severity: 'HIGH',
-        fix: 'Remove PII from analytics tracking data',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/359.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    const sensitiveFields = ['email', 'ssn', 'creditcard', 'password', 'phone', 'address'];
-    
-    function report(node: TSESTree.Node, field: string) {
-      context.report({ node, messageId: 'violationDetected', data: { field } });
-    }
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // analytics.track() with sensitive data
-        if (node.callee.type === 'MemberExpression' &&
-            node.callee.object.name === 'analytics' &&
-            node.callee.property.name === 'track') {
-          
-          const dataArg = node.arguments[1];
-          if (dataArg?.type === 'ObjectExpression') {
-            dataArg.properties.forEach(prop => {
-              if (prop.type === 'Property') {
-                const key = prop.key.name?.toLowerCase();
-                const matchedField = sensitiveFields.find(f => key?.includes(f));
-                if (matchedField) {
-                  report(prop, matchedField);
-                }
-              }
-            });
-          }
-        }
-      },
-    };
-  },
-});
-

package/src/rules/no-sensitive-data-in-analytics/no-sensitive-data-in-analytics.test.ts

@@ -1,42 +0,0 @@
-/**
- * @fileoverview Tests for no-sensitive-data-in-analytics
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noSensitiveDataInAnalytics } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-sensitive-data-in-analytics', noSensitiveDataInAnalytics, {
-  valid: [
-    // Non-sensitive analytics
-    { code: "analytics.track('page_view', { page: '/home' })" },
-    { code: "analytics.track('click', { element: 'button', action: 'submit' })" },
-    { code: "gtag('event', 'click', { element: 'button' })" },
-    // Non-analytics code
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Email in analytics
-    { code: "analytics.track('signup', { email: user.email })", errors: [{ messageId: 'violationDetected' }] },
-    { code: "analytics.track('login', { userEmail: email })", errors: [{ messageId: 'violationDetected' }] },
-    // SSN
-    { code: "analytics.track('verify', { ssn: userSSN })", errors: [{ messageId: 'violationDetected' }] },
-    // Credit card
-    { code: "analytics.track('purchase', { creditcard: card })", errors: [{ messageId: 'violationDetected' }] },
-    // Password
-    { code: "analytics.track('auth', { password: pwd })", errors: [{ messageId: 'violationDetected' }] },
-    // Phone
-    { code: "analytics.track('contact', { phone: number })", errors: [{ messageId: 'violationDetected' }] },
-    // Address
-    { code: "analytics.track('order', { address: addr })", errors: [{ messageId: 'violationDetected' }] },
-    // Multiple sensitive fields
-    { code: "analytics.track('profile', { email: e, phone: p })", errors: [{ messageId: 'violationDetected' }, { messageId: 'violationDetected' }] },
-  ],
-});