eslint-plugin-secure-coding 3.0.0 → 3.0.2

package/src/rules/no-arbitrary-file-access/index.js

@@ -1,195 +0,0 @@
-"use strict";
-/**
- * @fileoverview Prevent file access from user input
- *
- * False Positive Reduction:
- * This rule detects safe patterns including:
- * - path.basename() sanitization
- * - path.join() with validated base directories
- * - startsWith() validation guards
- * - Early-return throw patterns
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noArbitraryFileAccess = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-exports.noArbitraryFileAccess = (0, eslint_devkit_1.createRule)({
-    name: 'no-arbitrary-file-access',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Prevent file access from user input',
-        },
-        messages: {
-            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Arbitrary File Access',
-                cwe: 'CWE-22',
-                description: 'File path from user input - path traversal vulnerability',
-                severity: 'HIGH',
-                fix: 'Validate and sanitize file paths, use allowlists',
-                documentationLink: 'https://cwe.mitre.org/data/definitions/22.html',
-            })
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        const sourceCode = context.sourceCode;
-        function report(node) {
-            context.report({ node, messageId: 'violationDetected' });
-        }
-        const fsReadMethods = ['readFile', 'readFileSync', 'readdir', 'readdirSync', 'stat', 'statSync'];
-        const fsWriteMethods = ['writeFile', 'writeFileSync', 'appendFile', 'appendFileSync'];
-        const userInputSources = ['req', 'request', 'params', 'query', 'body'];
-        // Track variables that have been sanitized with path.basename()
-        const sanitizedVariables = new Set();
-        // Track variables that have been validated with startsWith() guards
-        const validatedVariables = new Set();
-        /**
-         * Check if a variable is assigned from path.basename() or path.join() with basename
-         */
-        function checkVariableDeclaration(node) {
-            if (node.id.type !== 'Identifier' || !node.init) {
-                return;
-            }
-            const varName = node.id.name;
-            const init = node.init;
-            // Check for path.basename() assignment
-            if (init.type === 'CallExpression' &&
-                init.callee.type === 'MemberExpression' &&
-                init.callee.object.type === 'Identifier' &&
-                init.callee.object.name === 'path' &&
-                init.callee.property.type === 'Identifier' &&
-                init.callee.property.name === 'basename') {
-                sanitizedVariables.add(varName);
-            }
-            // Check for path.join() with a sanitized variable or literal base
-            if (init.type === 'CallExpression' &&
-                init.callee.type === 'MemberExpression' &&
-                init.callee.object.type === 'Identifier' &&
-                init.callee.object.name === 'path' &&
-                init.callee.property.type === 'Identifier' &&
-                init.callee.property.name === 'join') {
-                // Check if any argument is a sanitized variable
-                const hasSanitizedArg = init.arguments.some((arg) => arg.type === 'Identifier' && sanitizedVariables.has(arg.name));
-                // Check if first arg is a safe base (literal or known safe variable)
-                const firstArg = init.arguments[0];
-                const hasSafeBase = firstArg && (firstArg.type === 'Literal' ||
-                    (firstArg.type === 'Identifier' && /^(SAFE|BASE|ROOT|UPLOAD|PUBLIC)/i.test(firstArg.name)));
-                if (hasSanitizedArg && hasSafeBase) {
-                    sanitizedVariables.add(varName);
-                }
-            }
-        }
-        /**
-         * Check if there's a startsWith() guard validation for this variable
-         * Looks for patterns like:
-         * if (!path.startsWith(baseDir)) { throw ... }
-         * if (!path.startsWith(baseDir)) { return ... }
-         */
-        function hasStartsWithGuard(node, varName) {
-            // Already validated
-            if (validatedVariables.has(varName)) {
-                return true;
-            }
-            // Walk up to find the containing block or function
-            let current = node.parent;
-            while (current) {
-                // If we've reached a function body or block, search its statements
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement) {
-                    const statements = current.body;
-                    // Look for IF statements in this block that validate our variable
-                    for (const stmt of statements) {
-                        if (stmt.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                            const testText = sourceCode.getText(stmt.test).toLowerCase();
-                            // Check for startsWith() validation pattern with our variable
-                            if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
-                                // Check if this is a guard clause (negated condition with throw/return)
-                                const consequent = stmt.consequent;
-                                // Handle block statement: if (...) { throw/return; }
-                                if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.BlockStatement && consequent.body.length > 0) {
-                                    const firstStmt = consequent.body[0];
-                                    if (firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || firstStmt.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
-                                        validatedVariables.add(varName);
-                                        return true;
-                                    }
-                                }
-                                // Handle direct statement: if (...) throw/return;
-                                if (consequent.type === eslint_devkit_1.AST_NODE_TYPES.ThrowStatement || consequent.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement) {
-                                    validatedVariables.add(varName);
-                                    return true;
-                                }
-                            }
-                        }
-                    }
-                }
-                // Also check if current IS an if statement (when node is inside the consequent)
-                if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
-                    const testText = sourceCode.getText(current.test).toLowerCase();
-                    if (testText.includes('startswith') && testText.includes(varName.toLowerCase())) {
-                        validatedVariables.add(varName);
-                        return true;
-                    }
-                }
-                current = current.parent;
-            }
-            return false;
-        }
-        /**
-         * Check if a variable comes from a sanitized/validated source
-         */
-        function isVariableSafe(varName, node) {
-            // Already tracked as sanitized
-            if (sanitizedVariables.has(varName)) {
-                return true;
-            }
-            // Has startsWith guard validation
-            if (hasStartsWithGuard(node, varName)) {
-                return true;
-            }
-            // Check naming conventions that suggest safety
-            if (/^(safe|sanitized|validated|clean)/i.test(varName)) {
-                return true;
-            }
-            return false;
-        }
-        return {
-            // Track variable declarations for sanitization patterns
-            VariableDeclarator(node) {
-                checkVariableDeclaration(node);
-            },
-            CallExpression(node) {
-                // Detect fs.* with user input
-                if (node.callee.type === 'MemberExpression' &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'fs' &&
-                    node.callee.property.type === 'Identifier' &&
-                    [...fsReadMethods, ...fsWriteMethods].includes(node.callee.property.name)) {
-                    const pathArg = node.arguments[0];
-                    // Skip if path is a literal (safe)
-                    if (pathArg && pathArg.type === 'Literal') {
-                        return;
-                    }
-                    // Check if path is a variable
-                    if (pathArg && pathArg.type === 'Identifier') {
-                        const varName = pathArg.name;
-                        // Skip if variable is sanitized or validated
-                        if (isVariableSafe(varName, node)) {
-                            return;
-                        }
-                        report(node);
-                        return;
-                    }
-                    // Flag if path is from a member expression (user input sources)
-                    if (pathArg?.type === 'MemberExpression' &&
-                        pathArg.object.type === 'Identifier') {
-                        const objName = pathArg.object.name.toLowerCase();
-                        if (userInputSources.includes(objName)) {
-                            report(node);
-                        }
-                    }
-                }
-            },
-        };
-    },
-});

package/src/rules/no-buffer-overread/index.d.ts

@@ -1,29 +0,0 @@
-/**
- * ESLint Rule: no-buffer-overread
- * Detects buffer access beyond bounds (CWE-126)
- *
- * Buffer overread occurs when reading from buffers beyond their allocated
- * length, potentially leading to information disclosure, crashes, or
- * other security issues.
- *
- * False Positive Reduction:
- * This rule uses security utilities to reduce false positives by detecting:
- * - Safe buffer access patterns
- * - Bounds checking operations
- * - JSDoc annotations (@safe, @validated)
- * - Input validation functions
- */
-import type { SecurityRuleOptions } from '@interlace/eslint-devkit';
-export interface Options extends SecurityRuleOptions {
-    /** Buffer methods to check for bounds safety */
-    bufferMethods?: string[];
-    /** Functions that validate buffer indices */
-    boundsCheckFunctions?: string[];
-    /** Buffer types to monitor */
-    bufferTypes?: string[];
-    /** Additional function names to consider as buffer index validators */
-    trustedSanitizers?: string[];
-    /** Additional JSDoc annotations to consider as safe markers */
-    strictMode?: boolean;
-}
-export declare const noBufferOverread: ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener>;