eslint-plugin-secure-coding 2.3.3 → 2.4.0

package/src/rules/no-tracking-without-consent/index.ts

@@ -1,78 +0,0 @@
-/**
- * @fileoverview Require consent before tracking
- */
-
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-type MessageIds = 'violationDetected';
-
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type, @typescript-eslint/no-empty-interface -- Rule has no configurable options
-export interface Options {}
-
-type RuleOptions = [Options?];
-
-export const noTrackingWithoutConsent = createRule<RuleOptions, MessageIds>({
-  name: 'no-tracking-without-consent',
-  meta: {
-    type: 'problem',
-    docs: {
-      description: 'Require consent before analytics tracking',
-    },
-    messages: {
-      violationDetected: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Tracking Without Consent',
-        cwe: 'CWE-359',
-        description: 'Analytics tracking without consent check - violates privacy regulations',
-        severity: 'MEDIUM',
-        fix: 'Wrap tracking calls in consent check: if (hasConsent) { analytics.track(...) }',
-        documentationLink: 'https://cwe.mitre.org/data/definitions/359.html',
-      })
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    function report(node: TSESTree.Node) {
-      context.report({ node, messageId: 'violationDetected' });
-    }
-    
-    function isInsideConsentCheck(node: TSESTree.Node): boolean {
-      let current: TSESTree.Node | undefined = node.parent;
-      while (current) {
-        if (current.type === 'IfStatement') {
-          return true;
-        }
-        if (current.type === 'ConditionalExpression') {
-          return true;
-        }
-        current = current.parent;
-      }
-      return false;
-    }
-    
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        // Detect analytics.track() or similar
-        if (node.callee.type === 'MemberExpression' &&
-            node.callee.object.type === 'Identifier' &&
-            node.callee.object.name === 'analytics' &&
-            node.callee.property.type === 'Identifier' &&
-            ['track', 'identify', 'page'].includes(node.callee.property.name)) {
-          
-          if (!isInsideConsentCheck(node)) {
-            report(node);
-          }
-        }
-        
-        // Google Analytics gtag
-        if (node.callee.type === 'Identifier' && node.callee.name === 'gtag') {
-          if (!isInsideConsentCheck(node)) {
-            report(node);
-          }
-        }
-      },
-    };
-  },
-});

package/src/rules/no-tracking-without-consent/no-tracking-without-consent.test.ts

@@ -1,34 +0,0 @@
-/**
- * @fileoverview Tests for no-tracking-without-consent
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noTrackingWithoutConsent } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-ruleTester.run('no-tracking-without-consent', noTrackingWithoutConsent, {
-  valid: [
-    // Tracking inside consent check
-    { code: "if (hasConsent) { analytics.track('event') }" },
-    { code: "if (userConsent) { gtag('event', 'click') }" },
-    { code: "if (consentGiven) { analytics.identify(userId) }" },
-    // Non-tracking calls
-    { code: "const x = 1" },
-    { code: "console.log('test')" },
-  ],
-
-  invalid: [
-    // Unconditional analytics.track
-    { code: "analytics.track('page_view')", errors: [{ messageId: 'violationDetected' }] },
-    { code: "analytics.identify(user)", errors: [{ messageId: 'violationDetected' }] },
-    { code: "analytics.page('/home')", errors: [{ messageId: 'violationDetected' }] },
-    // Unconditional gtag
-    { code: "gtag('event', 'purchase')", errors: [{ messageId: 'violationDetected' }] },
-  ],
-});