eslint-plugin-security 1.4.0 → 1.6.0

package/rules/detect-non-literal-fs-filename.js

@@ -3,47 +3,100 @@
  * @author Adam Baldwin
  */
 
+'use strict';
+
+const fsMetaData = require('../utils/data/fsFunctionData.json');
+const funcNames = Object.keys(fsMetaData);
+const fsPackageNames = ['fs', 'node:fs', 'fs/promises', 'node:fs/promises', 'fs-extra'];
+
+const { getImportAccessPath } = require('../utils/import-utils');
+
 //------------------------------------------------------------------------------
-// Rule Definition
+// Utils
 //------------------------------------------------------------------------------
 
-var names = [];
-var fsMetaData = require('./data/fsFunctionData.json');
-var funcNames = Object.keys(fsMetaData);
+function getIndices(node, argMeta) {
+  return (argMeta || []).filter((argIndex) => node.arguments[argIndex].type !== 'Literal');
+}
 
-module.exports = function(context) {
+function generateReport({ context, node, packageName, methodName, indices }) {
+  if (!indices || indices.length === 0) {
+    return;
+  }
+  context.report({ node, message: `Found ${methodName} from package "${packageName}" with non literal argument at index ${indices.join(',')}` });
+}
 
-    "use strict";
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
 
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-fs-filename.md',
+    },
+  },
+  create: function (context) {
     return {
-        "MemberExpression": function (node) {
-            var result = [];
-            if (funcNames.indexOf(node.property.name) !== -1) {
-                var meta = fsMetaData[node.property.name];
-                var args = node.parent.arguments;
-                meta.forEach(function (i) {
-                    if (args && args.length > i) {
-                        if (args[i].type !== 'Literal') {
-                            result.push(i);
-                        }
-                    }
-                });
-            }
-
-            if (result.length > 0) {
-                var token = context.getTokens(node)[0];
-                return context.report(node, 'Found fs.' + node.property.name + ' with non literal argument at index ' + result.join(','));
-            }
-
-
-            /*
-            if (node.parent && node.parent.arguments && node.parent.arguments[index].value) {
-                return context.report(node, 'found Buffer.' + node.property.name + ' with noAssert flag set true');
-
-            }
-            */
+      CallExpression: function (node) {
+        // don't check require. If all arguments are Literals, it's surely safe!
+        if ((node.callee.type === 'Identifier' && node.callee.name === 'require') || node.arguments.every((argument) => argument.type === 'Literal')) {
+          return;
         }
 
-    };
+        const pathInfo = getImportAccessPath({
+          node: node.callee,
+          scope: context.getScope(),
+          packageNames: fsPackageNames,
+        });
+        if (!pathInfo) {
+          return;
+        }
+        let fnName;
+        if (pathInfo.path.length === 1) {
+          // Check for:
+          // | var something = require('fs').readFile;
+          // | something(a);
+          // ,
+          // | var something = require('fs');
+          // | something.readFile(c);
+          // ,
+          // | var { readFile: something } = require('fs')
+          // | readFile(filename);
+          // ,
+          // | import { readFile as something } from 'fs';
+          // | something(filename);
+          // , or
+          // | import * as something from 'fs';
+          // | something.readFile(c);
+          fnName = pathInfo.path[0];
+        } else if (pathInfo.path.length === 2) {
+          // Check for:
+          // | var something = require('fs').promises;
+          // | something.readFile(filename)
+          fnName = pathInfo.path[1];
+        } else {
+          return;
+        }
+        if (!funcNames.includes(fnName)) {
+          return false;
+        }
+        const packageName = pathInfo.packageName;
+
+        const indices = getIndices(node, fsMetaData[fnName]);
 
+        generateReport({
+          context,
+          node,
+          packageName,
+          methodName: fnName,
+          indices,
+        });
+      },
+    };
+  },
 };

package/rules/detect-non-literal-regexp.js

@@ -3,26 +3,32 @@
  * @author Jon Lamendola
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-
-module.exports = function(context) {
-
-        "use strict";
-
-        return {
-                "NewExpression": function(node) {
-                        if (node.callee.name === 'RegExp') {
-                                var args = node.arguments;
-                                if (args && args.length > 0 && args[0].type !== 'Literal') {
-                                        var token = context.getTokens(node)[0];
-                                        return context.report(node, 'Found non-literal argument to RegExp Constructor');
-                                }
-                        }
-
-                }
-
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-regexp.md',
+    },
+  },
+  create: function (context) {
+    return {
+      NewExpression: function (node) {
+        if (node.callee.name === 'RegExp') {
+          const args = node.arguments;
+          if (args && args.length > 0 && args[0].type !== 'Literal') {
+            return context.report({ node: node, message: 'Found non-literal argument to RegExp Constructor' });
+          }
         }
-}
+      },
+    };
+  },
+};

package/rules/detect-non-literal-require.js

@@ -1,29 +1,37 @@
 /**
  * Tries to detect calls to require with non-literal argument
- * @author Adam Baldwin 
+ * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-module.exports = function(context) {
-
-    "use strict";
-
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-require.md',
+    },
+  },
+  create: function (context) {
     return {
-        "CallExpression": function (node) {
-            if (node.callee.name === 'require') {
-                var args = node.arguments;
-                if (args && args.length > 0 && args[0].type !== 'Literal') {
-                    var token = context.getTokens(node)[0];
-                    return context.report(node, 'Found non-literal argument in require');
-                }
-            }
-
+      CallExpression: function (node) {
+        if (node.callee.name === 'require') {
+          const args = node.arguments;
+          if (
+            (args && args.length > 0 && args[0].type === 'TemplateLiteral' && args[0].expressions.length > 0) ||
+            (args[0].type !== 'TemplateLiteral' && args[0].type !== 'Literal')
+          ) {
+            return context.report({ node: node, message: 'Found non-literal argument in require' });
+          }
         }
-
+      },
     };
-
+  },
 };
-

package/rules/detect-object-injection.js

@@ -3,77 +3,79 @@
  * @author Jon Lamendola
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-var Sinks = [];
-function getSerialize (fn, decycle) {
-  var seen = [], keys = [];
-  decycle = decycle || function(key, value) {
-    return '[Circular ' + getPath(value, seen, keys) + ']'
-  };
-  return function(key, value) {
-    var ret = value;
+const getPath = (value, seen, keys) => {
+  let index = seen.indexOf(value);
+  const path = [keys[index]];
+  for (index--; index >= 0; index--) {
+    if (seen[index][path[0]] === value) {
+      value = seen[index];
+      path.unshift(keys[index]);
+    }
+  }
+  return `~${path.join('.')}`;
+};
+
+const getSerialize = (fn, decycle) => {
+  const seen = [];
+  const keys = [];
+  decycle =
+    decycle ||
+    function (key, value) {
+      return `[Circular ${getPath(value, seen, keys)}]`;
+    };
+  return function (key, value) {
+    let ret = value;
     if (typeof value === 'object' && value) {
-      if (seen.indexOf(value) !== -1)
+      if (seen.indexOf(value) !== -1) {
         ret = decycle(key, value);
-      else {
+      } else {
         seen.push(value);
         keys.push(key);
       }
     }
-    if (fn) ret = fn(key, ret);
-    return ret;
-  }
-}
-
-function getPath (value, seen, keys) {
-  var index = seen.indexOf(value);
-  var path = [ keys[index] ];
-  for (index--; index >= 0; index--) {
-    if (seen[index][ path[0] ] === value) {
-      value = seen[index];
-      path.unshift(keys[index]);
+    if (fn) {
+      ret = fn(key, ret);
     }
-  }
-  return '~' + path.join('.');
-}
+    return ret;
+  };
+};
 
-function stringify(obj, fn, spaces, decycle) {
+const stringify = (obj, fn, spaces, decycle) => {
   return JSON.stringify(obj, getSerialize(fn, decycle), spaces);
-}
-
-stringify.getSerialize = getSerialize;module.exports = function(context) {
-
-        "use strict";
-
-var isChanged = false;
-
-
-
-        return {
-            "MemberExpression": function(node) {
-
-                if (node.computed === true) {
-                    var token = context.getTokens(node)[0];
-                    if (node.property.type === 'Identifier') {
-                        if (node.parent.type === 'VariableDeclarator') {
-   context.report(node, 'Variable Assigned to Object Injection Sink');
-    
-                        } else if (node.parent.type === 'CallExpression') {
-                        //    console.log(node.parent)
-  context.report(node, 'Function Call Object Injection Sink');
-                        } else {
-                        context.report(node, 'Generic Object Injection Sink');
-    
-                        }
-
-                    }
-                }
+};
 
+stringify.getSerialize = getSerialize;
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects "variable[key]" as a left- or right-hand assignment operand.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-object-injection.md',
+    },
+  },
+  create: function (context) {
+    return {
+      MemberExpression: function (node) {
+        if (node.computed === true) {
+          if (node.property.type === 'Identifier') {
+            if (node.parent.type === 'VariableDeclarator') {
+              context.report({ node: node, message: 'Variable Assigned to Object Injection Sink' });
+            } else if (node.parent.type === 'CallExpression') {
+              context.report({ node: node, message: 'Function Call Object Injection Sink' });
+            } else {
+              context.report({ node: node, message: 'Generic Object Injection Sink' });
             }
-
-        };
-    }
-
+          }
+        }
+      },
+    };
+  },
+};

package/rules/detect-possible-timing-attacks.js

@@ -3,58 +3,56 @@
  * @author Adam Baldwin / Jon Lamendola
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-var keywords = '((' + [
-    'password',
-    'secret',
-    'api',
-    'apiKey',
-    'token',
-    'auth',
-    'pass',
-    'hash'
-].join(')|(') + '))';
-
-var re = new RegExp('^' + keywords + '$', 'im');
+const keywords = `((${['password', 'secret', 'api', 'apiKey', 'token', 'auth', 'pass', 'hash'].join(')|(')}))`;
 
-function containsKeyword (node) {
-    if (node.type === 'Identifier') {
-        if (re.test(node.name))
-            return true;
-        }
-        return
-}
+const re = new RegExp(`^${keywords}$`, 'im');
 
-module.exports = function(context) {
-
-    "use strict";
+const containsKeyword = (node) => {
+  if (node.type === 'Identifier') {
+    if (re.test(node.name)) {
+      return true;
+    }
+  }
+  return;
+};
 
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-possible-timing-attacks.md',
+    },
+  },
+  create: function (context) {
     return {
-        "IfStatement": function(node) {
-            if (node.test && node.test.type === 'BinaryExpression') {
-                if (node.test.operator === '==' || node.test.operator === '===' || node.test.operator === '!=' || node.test.operator === '!==') {
-
-                    var token = context.getTokens(node)[0];
-
-                    if (node.test.left) {
-                    var left = containsKeyword(node.test.left);
-                        if (left) {
-                            return context.report(node, "Potential timing attack, left side: " + left);
-                        }
-                    }
+      IfStatement: function (node) {
+        if (node.test && node.test.type === 'BinaryExpression') {
+          if (node.test.operator === '==' || node.test.operator === '===' || node.test.operator === '!=' || node.test.operator === '!==') {
+            if (node.test.left) {
+              const left = containsKeyword(node.test.left);
+              if (left) {
+                return context.report({ node: node, message: `Potential timing attack, left side: ${left}` });
+              }
+            }
 
-                    if (node.test.right) {
-                    var right = containsKeyword(node.test.right);
-                        if (right) {
-                            return context.report(node, "Potential timing attack, right side: " + right);
-                        }
-                    }
-                }
+            if (node.test.right) {
+              const right = containsKeyword(node.test.right);
+              if (right) {
+                return context.report({ node: node, message: `Potential timing attack, right side: ${right}` });
+              }
             }
+          }
         }
+      },
     };
-
+  },
 };

package/rules/detect-pseudoRandomBytes.js

@@ -3,22 +3,29 @@
  * @author Adam Baldwin
  */
 
+'use strict';
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-module.exports = function(context) {
-
-    "use strict";
-
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-pseudoRandomBytes.md',
+    },
+  },
+  create: function (context) {
     return {
-        "MemberExpression": function (node) {
-            if (node.property.name === 'pseudoRandomBytes') {
-                var token = context.getTokens(node)[0];
-                return context.report(node, 'Found crypto.pseudoRandomBytes which does not produce cryptographically strong numbers');
-            }
+      MemberExpression: function (node) {
+        if (node.property.name === 'pseudoRandomBytes') {
+          return context.report({ node: node, message: 'Found crypto.pseudoRandomBytes which does not produce cryptographically strong numbers' });
         }
-
+      },
     };
-
+  },
 };

package/rules/detect-unsafe-regex.js

@@ -1,37 +1,50 @@
-var safe = require('safe-regex');
 /**
  * Check if the regex is evil or not using the safe-regex module
  * @author Adam Baldwin
  */
 
+'use strict';
+
+//-----------------------------------------------------------------------------
+// Requirements
+//-----------------------------------------------------------------------------
+
+const safe = require('safe-regex');
+
 //------------------------------------------------------------------------------
 // Rule Definition
 //------------------------------------------------------------------------------
 
-module.exports = function(context) {
-
-    "use strict";
-
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.',
+      category: 'Possible Security Vulnerability',
+      recommended: true,
+      url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-unsafe-regex.md',
+    },
+  },
+  create: function (context) {
     return {
-        "Literal": function(node) {
-            var token = context.getTokens(node)[0],
-                nodeType = token.type,
-                nodeValue = token.value;
+      Literal: function (node) {
+        const token = context.getSourceCode().getTokens(node)[0];
+        const nodeType = token.type;
+        const nodeValue = token.value;
 
-            if (nodeType === "RegularExpression") {
-                if (!safe(nodeValue)) {
-                    context.report(node, "Unsafe Regular Expression");
-                }
-            }
-        },
-        "NewExpression": function(node) {
-            if (node.callee.name == "RegExp" && node.arguments && node.arguments.length > 0 && node.arguments[0].type == "Literal") {
-                if (!safe(node.arguments[0].value)) {
-                    context.report(node, "Unsafe Regular Expression (new RegExp)");
-                }
-            }
+        if (nodeType === 'RegularExpression') {
+          if (!safe(nodeValue)) {
+            context.report({ node: node, message: 'Unsafe Regular Expression' });
+          }
+        }
+      },
+      NewExpression: function (node) {
+        if (node.callee.name === 'RegExp' && node.arguments && node.arguments.length > 0 && node.arguments[0].type === 'Literal') {
+          if (!safe(node.arguments[0].value)) {
+            context.report({ node: node, message: 'Unsafe Regular Expression (new RegExp)' });
+          }
         }
+      },
     };
-
+  },
 };
-

package/test/detect-bidi-characters.js

@@ -0,0 +1,74 @@
+'use strict';
+
+const RuleTester = require('eslint').RuleTester;
+const tester = new RuleTester();
+
+const ruleName = 'detect-bidi-characters';
+const Rule = require(`../rules/${ruleName}`);
+
+tester.run(ruleName, Rule, {
+  valid: [
+    {
+      code: `
+  var accessLevel = "user";
+  if (accessLevel != "user") { // Check if admin
+    console.log("You are an admin.");
+  }
+  `,
+    },
+  ],
+  invalid: [
+    {
+      code: `
+      var accessLevel = "user";
+      if (accessLevel != "user‮ ⁦// Check if admin⁩ ⁦") {
+          console.log("You are an admin.");
+      }
+      `,
+      errors: [
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this code/i, line: 3, endLine: 3, column: 31, endColumn: 32 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this code/i, line: 3, endLine: 3, column: 33, endColumn: 34 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this code/i, line: 3, endLine: 3, column: 51, endColumn: 52 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this code/i, line: 3, endLine: 3, column: 53, endColumn: 54 },
+      ],
+    },
+  ],
+});
+
+tester.run(`${ruleName} in comment-line`, Rule, {
+  valid: [
+    {
+      code: `
+  var isAdmin = false;
+  /* begin admins only */ if (isAdmin) {
+    console.log("You are an admin.");
+  /* end admins only */ }
+  `,
+    },
+  ],
+  invalid: [
+    {
+      code: `
+      var isAdmin = false;
+      /*‮ } ⁦if (isAdmin)⁩ ⁦ begin admins only */
+          console.log("You are an admin.");
+      /* end admins only ‮
+⁦*/
+      /* end admins only ‮ 
+ { ⁦*/
+        `,
+      errors: [
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 3, endLine: 3, column: 9, endColumn: 10 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 3, endLine: 3, column: 13, endColumn: 14 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 3, endLine: 3, column: 26, endColumn: 27 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 3, endLine: 3, column: 28, endColumn: 29 },
+
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 5, endLine: 5, column: 26, endColumn: 27 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 6, endLine: 6, column: 1, endColumn: 2 },
+
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 7, endLine: 7, column: 26, endColumn: 27 },
+        { message: /Detected potential trojan source attack with unicode bidi introduced in this comment/i, line: 8, endLine: 8, column: 4, endColumn: 5 },
+      ],
+    },
+  ],
+});