eslint-plugin-security 1.2.0 → 1.5.0

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "eslint-plugin-security",
-  "version": "1.2.0",
+  "version": "1.5.0",
   "description": "Security rules for eslint",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "changelog": "changelog eslint-plugin-security all > CHANGELOG.md",
+    "release": "npx semantic-release",
+    "test": "mocha test/**/*",
+    "format": "prettier --write **/*.{md,js,yml}",
+    "lint": "eslint .",
+    "lint:fix": "eslint --fix .",
+    "cont-int": "npm test && npm run lint"
   },
   "repository": {
     "type": "git",
@@ -21,10 +27,29 @@
     "url": "https://github.com/nodesecurity/eslint-plugin-security/issues"
   },
   "homepage": "https://github.com/nodesecurity/eslint-plugin-security#readme",
+  "gitHooks": {
+    "pre-commit": "lint-staged"
+  },
+  "lint-staged": {
+    "*.js": [
+      "prettier --write",
+      "eslint --fix"
+    ],
+    "*.md": "prettier --write",
+    "*.yml": "prettier --write"
+  },
   "dependencies": {
-    "safe-regex": "^1.1.0"
+    "safe-regex": "^2.1.1"
   },
   "devDependencies": {
-    "eslint": "^1.8.0"
+    "changelog": "1.3.0",
+    "eslint": "^8.11.0",
+    "eslint-config-nodesecurity": "^1.3.1",
+    "eslint-config-prettier": "^8.5.0",
+    "lint-staged": "^12.3.7",
+    "mocha": "^9.2.2",
+    "prettier": "^2.6.2",
+    "semantic-release": "^19.0.2",
+    "yorkie": "^2.0.0"
   }
 }

package/rules/data/fsFunctionData.json

@@ -1,51 +1,51 @@
 {
-    "appendFile": [0],
-    "appendFileSync": [0],
-    "chmod": [0],
-    "chmodSync": [0],
-    "chown": [0],
-    "chownSync": [0],
-    "createReadStream": [0],
-    "createWriteStream": [0],
-    "exists": [0],
-    "existsSync": [0],
-    "lchmod": [0],
-    "lchmodSync": [0],
-    "lchown": [0],
-    "lchownSync": [0],
-    "link": [0,1],
-    "linkSync": [0,1],
-    "lstat": [0],
-    "lstatSync": [0],
-    "mkdir": [0],
-    "mkdirSync": [0],
-    "open": [0],
-    "openSync": [0],
-    "readdir": [0],
-    "readdirSync": [0],
-    "readFile": [0],
-    "readFileSync": [0],
-    "readlink": [0],
-    "readlinkSync": [0],
-    "realpath": [0],
-    "realpathSync": [0],
-    "rename": [0,1],
-    "renameSync": [0,1],
-    "rmdir": [0],
-    "rmdirSync": [0],
-    "stat": [0],
-    "statSync": [0],
-    "symlink": [0,1],
-    "symlinkSync": [0,1],
-    "truncate": [0],
-    "truncateSync": [0],
-    "unlink": [0],
-    "unlinkSync": [0],
-    "unwatchFile": [0],
-    "utimes": [0],
-    "utimesSync": [0],
-    "watch": [0],
-    "watchFile": [0],
-    "writeFile": [0],
-    "writeFileSync": [0]
+  "appendFile": [0],
+  "appendFileSync": [0],
+  "chmod": [0],
+  "chmodSync": [0],
+  "chown": [0],
+  "chownSync": [0],
+  "createReadStream": [0],
+  "createWriteStream": [0],
+  "exists": [0],
+  "existsSync": [0],
+  "lchmod": [0],
+  "lchmodSync": [0],
+  "lchown": [0],
+  "lchownSync": [0],
+  "link": [0, 1],
+  "linkSync": [0, 1],
+  "lstat": [0],
+  "lstatSync": [0],
+  "mkdir": [0],
+  "mkdirSync": [0],
+  "open": [0],
+  "openSync": [0],
+  "readdir": [0],
+  "readdirSync": [0],
+  "readFile": [0],
+  "readFileSync": [0],
+  "readlink": [0],
+  "readlinkSync": [0],
+  "realpath": [0],
+  "realpathSync": [0],
+  "rename": [0, 1],
+  "renameSync": [0, 1],
+  "rmdir": [0],
+  "rmdirSync": [0],
+  "stat": [0],
+  "statSync": [0],
+  "symlink": [0, 1],
+  "symlinkSync": [0, 1],
+  "truncate": [0],
+  "truncateSync": [0],
+  "unlink": [0],
+  "unlinkSync": [0],
+  "unwatchFile": [0],
+  "utimes": [0],
+  "utimesSync": [0],
+  "watch": [0],
+  "watchFile": [0],
+  "writeFile": [0],
+  "writeFileSync": [0]
 }

package/rules/detect-buffer-noassert.js

@@ -1,74 +1,80 @@
 /**
  * Tries to detect buffer read / write calls that use noAssert set to true
- * @author Adam Baldwin 
+ * @author Adam Baldwin
  */
 
-//------------------------------------------------------------------------------
-// Rule Definition
-//------------------------------------------------------------------------------
-
-var names = [];
+'use strict';
 
-module.exports = function(context) {
+//-----------------------------------------------------------------------------
+// Helpers
+//-----------------------------------------------------------------------------
 
-    "use strict";
+const read = [
+  'readUInt8',
+  'readUInt16LE',
+  'readUInt16BE',
+  'readUInt32LE',
+  'readUInt32BE',
+  'readInt8',
+  'readInt16LE',
+  'readInt16BE',
+  'readInt32LE',
+  'readInt32BE',
+  'readFloatLE',
+  'readFloatBE',
+  'readDoubleLE',
+  'readDoubleBE',
+];
 
-    var read = [
-        "readUInt8",
-        "readUInt16LE",
-        "readUInt16BE",
-        "readUInt32LE",
-        "readUInt32BE",
-        "readInt8",
-        "readInt16LE",
-        "readInt16BE",
-        "readInt32LE",
-        "readInt32BE",
-        "readFloatLE",
-        "readFloatBE",
-        "readDoubleL",
-        "readDoubleBE"
-    ];
+const write = [
+  'writeUInt8',
+  'writeUInt16LE',
+  'writeUInt16BE',
+  'writeUInt32LE',
+  'writeUInt32BE',
+  'writeInt8',
+  'writeInt16LE',
+  'writeInt16BE',
+  'writeInt32LE',
+  'writeInt32BE',
+  'writeFloatLE',
+  'writeFloatBE',
+  'writeDoubleLE',
+  'writeDoubleBE',
+];
 
-    var write = [
-        "writeUInt8",
-        "writeUInt16LE",
-        "writeUInt16BE",
-        "writeUInt32LE",
-        "writeUInt32BE",
-        "writeInt8",
-        "writeInt16LE",
-        "writeInt16BE",
-        "writeInt32LE",
-        "writeInt32BE",
-        "writeFloatLE",
-        "writeFloatBE",
-        "writeDoubleLE",
-        "writeDoubleBE"
-    ];
-
-
-    var getSource = function (token) {
-        return token.loc.start.line+ ':  ' + context.getSourceLines().slice(token.loc.start.line-1, token.loc.end.line).join('\n\t');
-    }
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
 
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detect calls to "buffer" with "noAssert" flag set.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security#detect-buffer-noassert',
+    },
+    __methodsToCheck: {
+      read,
+      write,
+    },
+  },
+  create: function (context) {
     return {
-        "MemberExpression": function (node) {
-            var index;
-            if (read.indexOf(node.property.name) !== -1) {
-                index = 1;
-            } else if (write.indexOf(node.property.name) !== -1) {
-                index = 2;
-            }
-
-            if (index && node.parent && node.parent.arguments && node.parent.arguments[index] &&  node.parent.arguments[index].value) {
-                var token = context.getTokens(node)[0];
-                return context.report(node, 'found Buffer.' + node.property.name + ' with noAssert flag set true:\n\t' + getSource(token));
-                
-            }
+      MemberExpression: function (node) {
+        let index;
+        if (read.indexOf(node.property.name) !== -1) {
+          index = 1;
+        } else if (write.indexOf(node.property.name) !== -1) {
+          index = 2;
         }
 
+        if (index && node.parent && node.parent.arguments && node.parent.arguments[index] && node.parent.arguments[index].value) {
+          return context.report(node, `Found Buffer.${node.property.name} with noAssert flag set true`);
+        }
+      },
     };
-
+  },
 };
-

package/rules/detect-child-process.js

@@ -3,44 +3,49 @@
  * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-var names = [];
-
-module.exports = function(context) {
-
-    "use strict";
-
-    var getSource = function (token) {
-        return token.loc.start.line+ ':  ' + context.getSourceLines().slice(token.loc.start.line-1, token.loc.end.line).join('\n\t');
-    }
-
+/*
+ * Stores variable names pointing to child_process to check (child_process).exec()
+ */
+const names = [];
+
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detect instances of "child_process" & non-literal "exec()" calls.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security/blob/main/docs/avoid-command-injection-node.md',
+    },
+  },
+  create: function (context) {
     return {
-        "CallExpression": function (node) {
-            var token = context.getTokens(node)[0];
-            if (node.callee.name === 'require') {
-                var args = node.arguments[0];
-                if (args && args.type === 'Literal' && args.value === 'child_process') {
-                    if (node.parent.type === 'VariableDeclarator') {
-                        names.push(node.parent.id.name);
-                    } else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
-                        names.push(node.parent.left.name);
-                    }
-                    return context.report(node, 'found require("child_process")\n\t' + getSource(token));
-                }
-            }
-        },
-        "MemberExpression": function (node) {
-            var token = context.getTokens(node)[0];
-            if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
-                if (node.parent && node.parent.arguments  && node.parent.arguments[0].type !== 'Literal') {
-                    return context.report(node, 'found child_process.exec() with non Literal first argument\n\t' + getSource(token));
-                }
+      CallExpression: function (node) {
+        if (node.callee.name === 'require') {
+          const args = node.arguments[0];
+          if (args && args.type === 'Literal' && args.value === 'child_process') {
+            if (node.parent.type === 'VariableDeclarator') {
+              names.push(node.parent.id.name);
+            } else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
+              names.push(node.parent.left.name);
             }
+            return context.report(node, 'Found require("child_process")');
+          }
         }
-
+      },
+      MemberExpression: function (node) {
+        if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
+          if (node.parent && node.parent.arguments.length && node.parent.arguments[0].type !== 'Literal') {
+            return context.report(node, 'Found child_process.exec() with non Literal first argument');
+          }
+        }
+      },
     };
-
+  },
 };

package/rules/detect-disable-mustache-escape.js

@@ -1,18 +1,28 @@
-module.exports = function(context) {
+'use strict';
 
-    "use strict";
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security#detect-disable-mustache-escape'
+    }
+  },
+  create: function (context) {
     return {
-        "AssignmentExpression": function(node) {
-            if (node.operator === '=') {
-                if (node.left.property) {
-                    if (node.left.property.name == 'escapeMarkup') {
-                        if (node.right.value == false) {
-                            context.report(node, 'Markup escaping disabled.')
-                        }
-                    }
-                }
+      AssignmentExpression: function (node) {
+        if (node.operator === '=') {
+          if (node.left.property) {
+            if (node.left.property.name === 'escapeMarkup') {
+              if (node.right.value === false) {
+                context.report(node, 'Markup escaping disabled.');
+              }
             }
+          }
         }
-    }
-
-}
+      }
+    };
+  }
+};

package/rules/detect-eval-with-expression.js

@@ -1,21 +1,31 @@
 /**
- * Idnetifies eval with expression
+ * Identifies eval with expression
  * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-module.exports = function(context) {
-
-    "use strict";
-
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security#detect-eval-with-expression'
+    }
+  },
+  create: function (context) {
     return {
-        "CallExpression": function(node) {
-            if (node.callee.name === "eval" && node.arguments[0].type !== 'Literal') {
-                context.report(node, "eval with argument of type " + node.arguments[0].type);
-            }
+      CallExpression: function (node) {
+        if (node.callee.name === 'eval' && node.arguments[0].type !== 'Literal') {
+          context.report(node, `eval with argument of type ${node.arguments[0].type}`);
         }
+      }
     };
+  }
 };

package/rules/detect-new-buffer.js

@@ -1,26 +1,22 @@
-module.exports = function (context) {
-
-    var getSource = function (node) {
-        var token = context.getTokens(node)[0];
-        return token.loc.start.line+ ':  ' + context.getSourceLines().slice(token.loc.start.line-1, token.loc.end.line).join('\n\t');
+'use strict';
+
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detect instances of new Buffer(argument) where argument is any non-literal value.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security/blob/main/README.md'
     }
-
-
-    // Detects instances of new Buffer(argument)
-    // where argument is any non literal value.
+  },
+  create: function (context) {
     return {
-      "NewExpression": function (node) {
-        if (node.callee.name === 'Buffer' &&
-          node.arguments[0] &&
-          node.arguments[0].type != 'Literal') {
-
-          return context.report(node, "Found new Buffer\n\t" + getSource(node));
+      NewExpression: function (node) {
+        if (node.callee.name === 'Buffer' && node.arguments[0] && node.arguments[0].type !== 'Literal') {
+          return context.report(node, 'Found new Buffer');
         }
-
-
-
       }
     };
-
-}
-
+  }
+};

package/rules/detect-no-csrf-before-method-override.js

@@ -1,35 +1,46 @@
 /**
- * Check and see if CSRF middleware is before methodOverride 
- * @author Adam Baldwin 
+ * Check and see if CSRF middleware is before methodOverride
+ * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-
-module.exports = function(context) {
-
-    "use strict";
-    var csrf = false;
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects Express "csrf" middleware setup before "method-override" middleware.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security/blob/main/docs/bypass-connect-csrf-protection-by-abusing.md',
+    },
+  },
+  create: function (context) {
+    let csrf = false;
 
     return {
-        "CallExpression": function(node) {
-            var token = context.getTokens(node)[0],
-                nodeType = token.type,
-                nodeValue = token.value;
-
-            if (nodeValue === "express") {
-                if (node.callee.property.name === "methodOverride" && csrf) {
-                    context.report(node, "express.csrf() middleware found before express.methodOverride()");
-                }
-                if (node.callee.property.name === "csrf") {
-                    // Keep track of found CSRF
-                    csrf = true;
-                }
-            }
+      CallExpression: function (node) {
+        const token = context.getTokens(node)[0];
+        const nodeValue = token.value;
+
+        if (nodeValue === 'express') {
+          if (!node.callee || !node.callee.property) {
+            return;
+          }
+
+          if (node.callee.property.name === 'methodOverride' && csrf) {
+            context.report(node, 'express.csrf() middleware found before express.methodOverride()');
+          }
+          if (node.callee.property.name === 'csrf') {
+            // Keep track of found CSRF
+            csrf = true;
+          }
         }
+      },
     };
-
+  },
 };
-

package/rules/detect-non-literal-fs-filename.js

@@ -3,51 +3,52 @@
  * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-var names = [];
-var fsMetaData = require('./data/fsFunctionData.json');
-var funcNames = Object.keys(fsMetaData);
-
-module.exports = function(context) {
-
-    "use strict";
-
-    var getSource = function (token) {
-        return token.loc.start.line+ ':  ' + context.getSourceLines().slice(token.loc.start.line-1, token.loc.end.line).join('\n\t');
-    }
-
+const fsMetaData = require('./data/fsFunctionData.json');
+const funcNames = Object.keys(fsMetaData);
+
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/nodesecurity/eslint-plugin-security#detect-non-literal-fs-filename',
+    },
+  },
+  create: function (context) {
     return {
-        "MemberExpression": function (node) {
-            var result = [];
-            if (funcNames.indexOf(node.property.name) !== -1) {
-                var meta = fsMetaData[node.property.name];
-                var args = node.parent.arguments;
-                meta.forEach(function (i) {
-                    if (args && args.length > i) {
-                        if (args[i].type !== 'Literal') {
-                            result.push(i);
-                        }
-                    }
-                });
-            }
-
-            if (result.length > 0) {
-                var token = context.getTokens(node)[0];
-                return context.report(node, 'found fs.' + node.property.name + ' with non literal argument at index ' + result.join(',') + '\n\t' + getSource(token));
+      MemberExpression: function (node) {
+        const result = [];
+        if (funcNames.indexOf(node.property.name) !== -1) {
+          const meta = fsMetaData[node.property.name];
+          const args = node.parent.arguments;
+          meta.forEach((i) => {
+            if (args && args.length > i) {
+              if (args[i].type !== 'Literal') {
+                result.push(i);
+              }
             }
+          });
+        }
 
-
-            /*
-            if (node.parent && node.parent.arguments && node.parent.arguments[index].value) {
-                return context.report(node, 'found Buffer.' + node.property.name + ' with noAssert flag set true:\n\t' + getSource(token));
-
-            }
-            */
+        if (result.length > 0) {
+          return context.report(node, `Found fs.${node.property.name} with non literal argument at index ${result.join(',')}`);
         }
 
-    };
+        /*
+              if (node.parent && node.parent.arguments && node.parent.arguments[index].value) {
+                  return context.report(node, 'found Buffer.' + node.property.name + ' with noAssert flag set true');
 
+              }
+              */
+      },
+    };
+  },
 };