eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-sensitive-data-in-cache/index.ts

@@ -1,59 +0,0 @@
-/**
- * @fileoverview Prevent caching sensitive data without encryption
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/524.html
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noSensitiveDataInCache = createRule<RuleOptions, MessageIds>({
-  name: 'no-sensitive-data-in-cache',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Prevent caching sensitive data without encryption',
-      category: 'Security',
-      recommended: true,
-      owaspMobile: ['M9'],
-      cweIds: ["CWE-524"],
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'violation Detected',
-        cwe: 'CWE-200',
-        description: 'Prevent caching sensitive data without encryption detected - Sensitive data in cache',
-        severity: 'HIGH',
-        fix: 'Review and apply secure practices',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/200.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        if (node.callee.type === 'MemberExpression' &&
-            node.callee.property.type === 'Identifier' &&
-            ['set', 'put', 'store'].includes(node.callee.property.name)) {
-          const keyArg = node.arguments[0];
-          if (keyArg && keyArg.type === 'Literal') {
-            const key = keyArg.value.toString().toLowerCase();
-            if (['password', 'token', 'credit', 'ssn'].some(k => key.includes(k))) {
-              context.report({ node, messageId: 'violationDetected' });
-            }
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-sensitive-data-in-cache/no-sensitive-data-in-cache.test.ts

@@ -1,32 +0,0 @@
-/**
- * @fileoverview Tests for no-sensitive-data-in-cache
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noSensitiveDataInCache } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-sensitive-data-in-cache', noSensitiveDataInCache, {
-  valid: [
-    // Non-sensitive cache operations
-    { code: "cache.set('theme', 'dark')" },
-    { code: "cache.put('language', 'en')" },
-    { code: "storage.store('settings', config)" },
-    // Non-cache calls
-    { code: "const x = 1" },
-  ],
-
-  invalid: [
-    // Caching sensitive data
-    { code: "cache.set('password', pwd)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "cache.put('token', authToken)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "cache.store('creditCard', card)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "cache.set('ssn', socialSecurity)", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});

package/src/rules/no-sql-injection/index.ts

@@ -1,424 +0,0 @@
-/**
- * ESLint Rule: no-sql-injection
- * Detects SQL injection vulnerabilities with LLM-optimized context
- * 
- * False Positive Reduction:
- * This rule uses security utilities to reduce false positives by detecting:
- * - Sanitized inputs (escape(), sanitize(), validator.escape(), etc.)
- * - Safe JSDoc annotations (@safe, @validated, @sanitized)
- * - ORM method calls (Prisma, TypeORM, Sequelize, Knex)
- * - Parameterized query patterns
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule } from '@interlace/eslint-devkit';
-import { formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import { 
-  createSafetyChecker,
-  isSanitizedInput,
-  hasSafeAnnotation,
-  isOrmMethodCall,
-  type SecurityRuleOptions,
-} from '@interlace/eslint-devkit';
-
-type MessageIds = 'sqlInjection' | 'useParameterized' | 'useORM' | 'strategyParameterize' | 'strategyORM' | 'strategySanitize';
-
-export interface Options extends SecurityRuleOptions {
-  /** Allow dynamic table names in queries. Default: false (stricter) */
-  allowDynamicTableNames?: boolean;
-
-  /** Functions considered safe for building queries */
-  trustedFunctions?: string[];
-
-  /** Strategy for fixing SQL injection: 'parameterize', 'orm', 'sanitize', or 'auto' */
-  strategy?: 'parameterize' | 'orm' | 'sanitize' | 'auto';
-}
-
-type RuleOptions = [Options?];
-
-export const noSqlInjection = createRule<RuleOptions, MessageIds>({
-  name: 'no-sql-injection',
-  meta: {
-    type: 'problem',
-    docs: {
-      description:
-        'Prevent SQL injection vulnerabilities with educational context',
-    },
-    fixable: 'code',
-    hasSuggestions: true,
-    messages: {
-      // Enterprise-grade message with auto-enriched OWASP 2025, CVSS, and compliance data
-      sqlInjection: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'SQL Injection',
-        cwe: 'CWE-89', // Auto-enriches: A05:2025, CVSS:9.8, [SOC2,PCI-DSS,HIPAA,ISO27001]
-        description: 'SQL Injection detected',
-        severity: 'CRITICAL',
-        fix: 'Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId])',
-        documentationLink: 'https://owasp.org/Top10/2025/A05_2025-Injection/',
-      }),
-      useParameterized: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use Parameterized Query',
-        description: 'Use parameterized query',
-        severity: 'LOW',
-        fix: 'db.query("SELECT * FROM users WHERE id = ?", [userId])',
-        documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
-      }),
-      useORM: formatLLMMessage({
-        icon: MessageIcons.INFO,
-        issueName: 'Use ORM',
-        description: 'Use ORM/Query Builder',
-        severity: 'LOW',
-        fix: 'db.user.findWhere({ id: userId })',
-        documentationLink: 'https://www.prisma.io/docs',
-      }),
-      strategyParameterize: formatLLMMessage({
-        icon: MessageIcons.STRATEGY,
-        issueName: 'Parameterize Strategy',
-        description: 'Use parameterized queries',
-        severity: 'LOW',
-        fix: 'Use ? or :name placeholders',
-        documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
-      }),
-      strategyORM: formatLLMMessage({
-        icon: MessageIcons.STRATEGY,
-        issueName: 'ORM Strategy',
-        description: 'Migrate to ORM for automatic protection',
-        severity: 'LOW',
-        fix: 'Use Prisma, TypeORM, or Sequelize',
-        documentationLink: 'https://www.prisma.io/docs',
-      }),
-      strategySanitize: formatLLMMessage({
-        icon: MessageIcons.STRATEGY,
-        issueName: 'Sanitize Strategy',
-        description: 'Add input sanitization (last resort)',
-        severity: 'LOW',
-        fix: 'Sanitize input as last resort',
-        documentationLink: 'https://owasp.org/www-community/attacks/SQL_Injection',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          allowDynamicTableNames: {
-            type: 'boolean',
-            default: false,
-          },
-          trustedFunctions: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strategy: {
-            type: 'string',
-            enum: ['parameterize', 'orm', 'sanitize', 'auto'],
-            default: 'auto',
-            description: 'Strategy for fixing SQL injection (auto = smart detection)'
-          },
-          // Security utilities options for false positive reduction
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-            description: 'Additional function names to consider as sanitizers',
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-            description: 'Additional JSDoc annotations to consider as safe markers (e.g., @safe)',
-          },
-          trustedOrmPatterns: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-            description: 'Additional ORM patterns to consider safe',
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-            description: 'Disable all false positive detection (strict mode)',
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      allowDynamicTableNames: false,
-      trustedFunctions: [],
-      strategy: 'auto',
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      trustedOrmPatterns: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    const opts = context.options[0] || {};
-    const { 
-      allowDynamicTableNames = false, 
-      trustedSanitizers = [],
-      trustedAnnotations = [],
-      trustedOrmPatterns = [],
-      strictMode = false,
-    } = opts;
-
-    const sourceCode = context.sourceCode || context.sourceCode;
-    const filename = context.filename || context.getFilename();
-
-    // Create safety checker for false positive detection
-    const safetyChecker = createSafetyChecker({
-      trustedSanitizers,
-      trustedAnnotations,
-      trustedOrmPatterns,
-      strictMode,
-    });
-
-
-    /**
-     * Check if a node contains SQL keywords
-     */
-    const containsSQLKeywords = (node: TSESTree.Node): boolean => {
-      // Use getText for all node types - it works correctly for template literals
-      const text = sourceCode.getText(node).toLowerCase();
-      
-      const sqlKeywords = [
-        'select',
-        'insert',
-        'update',
-        'delete',
-        'drop',
-        'create',
-        'alter',
-        'exec',
-        'execute',
-      ];
-      return sqlKeywords.some((keyword) => text.includes(keyword));
-    };
-
-    /**
-     * Check if string interpolation contains user input
-     */
-    const containsUnsafeInterpolation = (
-      node: TSESTree.TemplateLiteral | TSESTree.BinaryExpression
-    ): boolean => {
-      if (node.type === 'TemplateLiteral') {
-        // Template literal with expressions is potentially unsafe
-        return node.expressions.length > 0;
-      }
-
-      if (node.type === 'BinaryExpression' && node.operator === '+') {
-        // String concatenation with variables is unsafe
-        return (
-          node.left.type !== 'Literal' || node.right.type !== 'Literal'
-        );
-      }
-
-      return false;
-    };
-
-    /**
-     * Check if template literal only has dynamic table name (if option allows it)
-     */
-    const isOnlyDynamicTableName = (node: TSESTree.TemplateLiteral): boolean => {
-      if (!allowDynamicTableNames) {
-        return false;
-      }
-      
-      // Must have exactly one expression (the table name)
-      if (node.expressions.length !== 1) {
-        return false;
-      }
-      
-      // Check if the pattern is just "SELECT * FROM ${tableName}" (no WHERE clause)
-      // sourceCode.getText(node) returns the template literal with backticks
-      const text = sourceCode.getText(node).toLowerCase();
-      
-      // Pattern: `SELECT * FROM ${tableName}` - must match the full template literal
-      // The text will be like: `select * from ${tablename}`
-      const tableNameOnlyPattern = /^`select\s+\*\s+from\s+\$\{[^}]+\}`$/;
-      
-      // Also check if it has WHERE or other clauses (still unsafe)
-      const hasWhereOrOtherClauses = /where|order\s+by|group\s+by|having|limit|offset/i.test(text);
-      
-      return !hasWhereOrOtherClauses && tableNameOnlyPattern.test(text);
-    };
-
-    /**
-     * Check if all interpolated expressions in a template literal are safe
-     */
-    /* c8 ignore start -- safetyChecker.isSafe and sanitization checks require JSDoc annotations not testable via RuleTester */
-    const areAllExpressionsSafe = (node: TSESTree.TemplateLiteral): boolean => {
-      return node.expressions.every((expr: TSESTree.Expression) => {
-        // Check if the expression is sanitized or has safe annotation
-        if (safetyChecker.isSafe(expr, context)) {
-          return true;
-        }
-        
-        // Check if expression is from a sanitization call directly
-        if (isSanitizedInput(expr, context, trustedSanitizers)) {
-          return true;
-        }
-        
-        return false;
-      });
-    };
-    /* c8 ignore stop */
-
-    /**
-     * Find the parent statement (VariableDeclaration, ExpressionStatement, etc.)
-     */
-    const findParentStatement = (node: TSESTree.Node): TSESTree.Node | null => {
-      let current: TSESTree.Node | undefined = node;
-      while (current?.parent) {
-        if (
-          current.parent.type === 'VariableDeclaration' ||
-          current.parent.type === 'ExpressionStatement' ||
-          current.parent.type === 'ReturnStatement'
-        ) {
-          return current.parent;
-        }
-        current = current.parent;
-      }
-      return null;
-    };
-
-    /**
-     * Check if the parent call is using an ORM or parameterized query
-     */
-    /* c8 ignore start -- isOrmMethodCall and hasSafeAnnotation require context patterns not testable via RuleTester */
-    const isInSafeContext = (node: TSESTree.Node): boolean => {
-      // Check if parent is an ORM call
-      let current: TSESTree.Node | undefined = node;
-      while (current) {
-        if (current.type === 'CallExpression') {
-          if (isOrmMethodCall(current, context, trustedOrmPatterns)) {
-            return true;
-          }
-        }
-        current = current.parent as TSESTree.Node | undefined;
-      }
-      
-      // Check for safe annotation on containing function
-      if (hasSafeAnnotation(node, context, trustedAnnotations)) {
-        return true;
-      }
-      
-      return false;
-    };
-    /* c8 ignore stop */
-
-    return {
-      // Check template literals
-      TemplateLiteral(node: TSESTree.TemplateLiteral) {
-        if (
-          !containsSQLKeywords(node) ||
-          !containsUnsafeInterpolation(node)
-        ) {
-          return;
-        }
-
-        // Allow dynamic table names if option is set and it's only a table name
-        if (isOnlyDynamicTableName(node)) {
-          return;
-        }
-
-        // FALSE POSITIVE REDUCTION:
-        // Skip if all interpolated expressions are sanitized
-        if (areAllExpressionsSafe(node)) {
-          return;
-        }
-
-        // Skip if in a safe context (ORM call, @safe annotation)
-        if (isInSafeContext(node)) {
-          return;
-        }
-
-        const queryText = sourceCode.getText(node);
-
-        // Find the parent statement to understand context
-        const parentStatement = findParentStatement(node);
-        const isInVariableDeclaration = parentStatement?.type === 'VariableDeclaration';
-
-        context.report({
-          node,
-          messageId: 'sqlInjection',
-          data: {
-            filePath: filename,
-            line: String(node.loc?.start.line ?? 0),
-          },
-          suggest: [
-            {
-              messageId: 'useParameterized',
-              fix: (fixer: TSESLint.RuleFixer) => {
-                // Generate parameterized version
-                const params: string[] = [];
-                let paramIndex = 1;
-
-                const parameterized = queryText.replace(
-                  /\$\{([^}]+)\}/g,
-                  (_: string, expr: string) => {
-                    params.push(expr);
-                    return `$${paramIndex++}`;
-                  }
-                );
-
-                // If assigned to a variable, wrap in db.query() call
-                // This produces valid JavaScript syntax
-                if (isInVariableDeclaration && parentStatement) {
-                  return fixer.replaceText(
-                    parentStatement,
-                    `${sourceCode.getText(parentStatement).split('=')[0].trim()} = db.query(${parameterized}, [${params.join(', ')}])`
-                  );
-                }
-
-                // For standalone template literals, wrap in db.query()
-                return fixer.replaceText(
-                  node,
-                  `db.query(${parameterized}, [${params.join(', ')}])`
-                );
-              },
-            },
-          ],
-        });
-      },
-
-      // Check binary expressions (string concatenation)
-      BinaryExpression(node: TSESTree.BinaryExpression) {
-        if (node.operator !== '+') return;
-
-        if (!containsSQLKeywords(node)) return;
-        if (!containsUnsafeInterpolation(node)) return;
-
-        // FALSE POSITIVE REDUCTION:
-        // Check if in a safe context (ORM call, @safe annotation)
-        if (isInSafeContext(node)) {
-          return;
-        }
-
-        // Check if concatenated values are sanitized
-        const checkSide = (side: TSESTree.Node): boolean => {
-          if (side.type === 'Literal') return true;
-          return safetyChecker.isSafe(side, context);
-        };
-
-        if (checkSide(node.left) && checkSide(node.right)) {
-          return;
-        }
-
-        context.report({
-          node,
-          messageId: 'sqlInjection',
-          data: {
-            filePath: filename,
-            line: String(node.loc?.start.line ?? 0),
-          },
-        });
-      },
-    };
-  },
-});
-