eslint-plugin-security 2.0.0 → 2.1.1

package/.eslint-doc-generatorrc.js

@@ -3,6 +3,7 @@ const prettierRC = require('./.prettierrc.json');
 
 /** @type {import('eslint-doc-generator').GenerateOptions} */
 const config = {
+  ignoreConfig: ['recommended-legacy'],
   postprocess: (doc) => format(doc, { ...prettierRC, parser: 'markdown' }),
 };
 

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+### [2.1.1](https://www.github.com/eslint-community/eslint-plugin-security/compare/v2.1.0...v2.1.1) (2024-02-14)
+
+
+### Bug Fixes
+
+* Ensure empty eval() doesn't crash detect-eval-with-expression ([#139](https://www.github.com/eslint-community/eslint-plugin-security/issues/139)) ([8a7c7db](https://www.github.com/eslint-community/eslint-plugin-security/commit/8a7c7db1e2b49e2831d510b8dc1db235dee0edf0))
+
+## [2.1.0](https://www.github.com/eslint-community/eslint-plugin-security/compare/v2.0.0...v2.1.0) (2023-12-15)
+
+
+### Features
+
+* add config recommended-legacy ([#132](https://www.github.com/eslint-community/eslint-plugin-security/issues/132)) ([13d3f2f](https://www.github.com/eslint-community/eslint-plugin-security/commit/13d3f2fc6ba327c894959db30462f3fda0272f0c))
+
 ## [2.0.0](https://www.github.com/eslint-community/eslint-plugin-security/compare/v1.7.1...v2.0.0) (2023-10-17)
 
 

package/README.md

@@ -20,6 +20,8 @@ yarn add --dev eslint-plugin-security
 
 ## Usage
 
+### Flat config (requires eslint >= v8.23.0)
+
 Add the following to your `eslint.config.js` file:
 
 ```js
@@ -28,6 +30,16 @@ const pluginSecurity = require('eslint-plugin-security');
 module.exports = [pluginSecurity.configs.recommended];
 ```
 
+### eslintrc config (deprecated)
+
+Add the following to your `.eslintrc` file:
+
+```js
+module.exports = {
+  extends: ['plugin:security/recommended-legacy'],
+};
+```
+
 ## Developer guide
 
 - Use [GitHub pull requests](https://help.github.com/articles/using-pull-requests).
@@ -52,21 +64,21 @@ npm test
 ⚠️ Configurations set to warn in.\
 ✅ Set in the `recommended` configuration.
 
-| Name                                                                                         | Description                                                                                                                   | ⚠️  |
-| :------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------- | :-- |
-| [detect-bidi-characters](docs/rules/detect-bidi-characters.md)                               | Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.                                      | ✅  |
-| [detect-buffer-noassert](docs/rules/detect-buffer-noassert.md)                               | Detects calls to "buffer" with "noAssert" flag set.                                                                           | ✅  |
-| [detect-child-process](docs/rules/detect-child-process.md)                                   | Detects instances of "child_process" & non-literal "exec()" calls.                                                            | ✅  |
-| [detect-disable-mustache-escape](docs/rules/detect-disable-mustache-escape.md)               | Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.     | ✅  |
-| [detect-eval-with-expression](docs/rules/detect-eval-with-expression.md)                     | Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.                               | ✅  |
-| [detect-new-buffer](docs/rules/detect-new-buffer.md)                                         | Detects instances of new Buffer(argument) where argument is any non-literal value.                                            | ✅  |
-| [detect-no-csrf-before-method-override](docs/rules/detect-no-csrf-before-method-override.md) | Detects Express "csrf" middleware setup before "method-override" middleware.                                                  | ✅  |
-| [detect-non-literal-fs-filename](docs/rules/detect-non-literal-fs-filename.md)               | Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.         | ✅  |
-| [detect-non-literal-regexp](docs/rules/detect-non-literal-regexp.md)                         | Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.          | ✅  |
-| [detect-non-literal-require](docs/rules/detect-non-literal-require.md)                       | Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk. | ✅  |
-| [detect-object-injection](docs/rules/detect-object-injection.md)                             | Detects "variable[key]" as a left- or right-hand assignment operand.                                                          | ✅  |
-| [detect-possible-timing-attacks](docs/rules/detect-possible-timing-attacks.md)               | Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.                                   | ✅  |
-| [detect-pseudoRandomBytes](docs/rules/detect-pseudoRandomBytes.md)                           | Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.                      | ✅  |
-| [detect-unsafe-regex](docs/rules/detect-unsafe-regex.md)                                     | Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.              | ✅  |
+| Name                                                                                         | Description                                                                                                                                                     | ⚠️  |
+| :------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-- |
+| [detect-bidi-characters](docs/rules/detect-bidi-characters.md)                               | Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.                                                                        | ✅  |
+| [detect-buffer-noassert](docs/rules/detect-buffer-noassert.md)                               | Detects calls to "buffer" with "noAssert" flag set.                                                                                                             | ✅  |
+| [detect-child-process](docs/rules/detect-child-process.md)                                   | Detects instances of "child_process" & non-literal "exec()" calls.                                                                                              | ✅  |
+| [detect-disable-mustache-escape](docs/rules/detect-disable-mustache-escape.md)               | Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.                                       | ✅  |
+| [detect-eval-with-expression](docs/rules/detect-eval-with-expression.md)                     | Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.                                                                 | ✅  |
+| [detect-new-buffer](docs/rules/detect-new-buffer.md)                                         | Detects instances of new Buffer(argument) where argument is any non-literal value. ([new Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)) | ✅  |
+| [detect-no-csrf-before-method-override](docs/rules/detect-no-csrf-before-method-override.md) | Detects Express "csrf" middleware setup before "method-override" middleware.                                                                                    | ✅  |
+| [detect-non-literal-fs-filename](docs/rules/detect-non-literal-fs-filename.md)               | Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.                                           | ✅  |
+| [detect-non-literal-regexp](docs/rules/detect-non-literal-regexp.md)                         | Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.                                            | ✅  |
+| [detect-non-literal-require](docs/rules/detect-non-literal-require.md)                       | Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.                                   | ✅  |
+| [detect-object-injection](docs/rules/detect-object-injection.md)                             | Detects "variable[key]" as a left- or right-hand assignment operand.                                                                                            | ✅  |
+| [detect-possible-timing-attacks](docs/rules/detect-possible-timing-attacks.md)               | Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.                                                                     | ✅  |
+| [detect-pseudoRandomBytes](docs/rules/detect-pseudoRandomBytes.md)                           | Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.                                                        | ✅  |
+| [detect-unsafe-regex](docs/rules/detect-unsafe-regex.md)                                     | Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.                                                | ✅  |
 
 <!-- end auto-generated rules list -->

package/docs/rules/detect-new-buffer.md

@@ -3,3 +3,7 @@
 ⚠️ This rule _warns_ in the ✅ `recommended` config.
 
 <!-- end auto-generated rule header -->
+
+`new Buffer()` now emits a deprecation warning in Node.js.
+
+More information: [new Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)

package/docs/rules/detect-object-injection.md

@@ -4,4 +4,35 @@
 
 <!-- end auto-generated rule header -->
 
+JavaScript allows you to use expressions to access object properties in addition to using dot notation. So instead of writing this:
+
+```js
+object.name = 'foo';
+```
+
+You can write this:
+
+```js
+object['name'] = 'foo';
+```
+
+Square bracket notation allows any expression to be used in place of an identifier, so you can also do this:
+
+```js
+const key = 'name';
+object[key] = 'foo';
+```
+
+By doing so, you've now obfuscated the property name from the reader, which makes it easy for a malicious actor to replace the value of `key` and change the behavior of the code.
+
+This rule flags any expression in the form of `object[expression]` no matter where it occurs. Examples of patterns this will be flagged are:
+
+```js
+object[key] = value;
+
+value = object[key];
+
+doSomething(object[key]);
+```
+
 More information: [The Dangers of Square Bracket Notation](../the-dangers-of-square-bracket-notation.md)

package/index.js

@@ -66,6 +66,14 @@ const recommended = {
   },
 };
 
-Object.assign(plugin.configs, { recommended });
+const recommendedLegacy = {
+  plugins: ['security'],
+  rules: recommended.rules,
+};
+
+Object.assign(plugin.configs, {
+  recommended,
+  'recommended-legacy': recommendedLegacy
+});
 
 module.exports = plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-security",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Security rules for eslint",
   "main": "index.js",
   "scripts": {

package/rules/detect-eval-with-expression.js

@@ -19,10 +19,10 @@ module.exports = {
       url: 'https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-eval-with-expression.md',
     },
   },
-  create: function (context) {
+  create(context) {
     return {
-      CallExpression: function (node) {
-        if (node.callee.name === 'eval' && node.arguments[0].type !== 'Literal') {
+      CallExpression(node) {
+        if (node.callee.name === 'eval' && node.arguments.length && node.arguments[0].type !== 'Literal') {
           context.report({ node: node, message: `eval with argument of type ${node.arguments[0].type}` });
         }
       },

package/test/configs/index.js

@@ -0,0 +1,16 @@
+'use strict';
+const plugin = require('../../index.js');
+const assert = require('assert').strict;
+
+describe('export plugin object', () => {
+  it('should export rules', () => {
+    assert(plugin.rules);
+    assert(typeof plugin.rules['detect-unsafe-regex'] === 'object');
+  });
+
+  it('should export configs', () => {
+    assert(plugin.configs);
+    assert(plugin.configs['recommended']);
+    assert(plugin.configs['recommended-legacy']);
+  });
+});

package/test/{detect-bidi-characters.js → rules/detect-bidi-characters.js}

@@ -4,7 +4,7 @@ const RuleTester = require('eslint').RuleTester;
 const tester = new RuleTester();
 
 const ruleName = 'detect-bidi-characters';
-const Rule = require(`../rules/${ruleName}`);
+const Rule = require(`../../rules/${ruleName}`);
 
 tester.run(ruleName, Rule, {
   valid: [
@@ -54,7 +54,7 @@ tester.run(`${ruleName} in comment-line`, Rule, {
           console.log("You are an admin.");
       /* end admins only ‮
 ⁦*/
-      /* end admins only ‮ 
+      /* end admins only ‮
  { ⁦*/
         `,
       errors: [

package/test/{detect-buffer-noassert.js → rules/detect-buffer-noassert.js}

@@ -4,7 +4,7 @@ const RuleTester = require('eslint').RuleTester;
 const tester = new RuleTester();
 
 const ruleName = 'detect-buffer-noassert';
-const rule = require(`../rules/${ruleName}`);
+const rule = require(`../../rules/${ruleName}`);
 
 const allMethodNames = [...rule.meta.__methodsToCheck.read, ...rule.meta.__methodsToCheck.write];
 

package/test/{detect-child-process.js → rules/detect-child-process.js}

@@ -9,7 +9,7 @@ const tester = new RuleTester({
 });
 
 const ruleName = 'detect-child-process';
-const rule = require(`../rules/${ruleName}`);
+const rule = require(`../../rules/${ruleName}`);
 
 tester.run(ruleName, rule, {
   valid: [

package/test/{detect-disable-mustache-escape.js → rules/detect-disable-mustache-escape.js}

@@ -5,7 +5,7 @@ const tester = new RuleTester();
 
 const ruleName = 'detect-disable-mustache-escape';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [{ code: 'escapeMarkup = false' }],
   invalid: [
     {

package/test/{detect-eval-with-expression.js → rules/detect-eval-with-expression.js}

@@ -5,8 +5,8 @@ const tester = new RuleTester();
 
 const ruleName = 'detect-eval-with-expression';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
-  valid: [{ code: "eval('alert()')" }],
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
+  valid: [{ code: "eval('alert()')" }, { code: 'eval("some nefarious code");' }, { code: 'eval()' }],
   invalid: [
     {
       code: 'eval(a);',

package/test/{detect-new-buffer.js → rules/detect-new-buffer.js}

@@ -6,7 +6,7 @@ const tester = new RuleTester();
 const ruleName = 'detect-new-buffer';
 const invalid = 'var a = new Buffer(c)';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [{ code: "var a = new Buffer('test')" }],
   invalid: [
     {

package/test/{detect-no-csrf-before-method-override.js → rules/detect-no-csrf-before-method-override.js}

@@ -5,7 +5,7 @@ const tester = new RuleTester();
 
 const ruleName = 'detect-no-csrf-before-method-override';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [{ code: 'express.methodOverride();express.csrf()' }],
   invalid: [
     {

package/test/{detect-non-literal-fs-filename.js → rules/detect-non-literal-fs-filename.js}

@@ -10,7 +10,7 @@ const tester = new RuleTester({
 
 const ruleName = 'detect-non-literal-fs-filename';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [
     {
       code: `var fs = require('fs');
@@ -29,7 +29,7 @@ tester.run(ruleName, require(`../rules/${ruleName}`), {
             import { promises as fsp } from 'fs';
             import fs from 'fs';
             import path from 'path';
-            
+
             const index = await fsp.readFile(path.resolve(__dirname, './index.html'), 'utf-8');
             const key = fs.readFileSync(path.join(__dirname, './ssl.key'));
             await fsp.writeFile(path.resolve(__dirname, './sitemap.xml'), sitemap);`,

package/test/{detect-non-literal-regexp.js → rules/detect-non-literal-regexp.js}

@@ -6,7 +6,7 @@ const tester = new RuleTester();
 const ruleName = 'detect-non-literal-regexp';
 const invalid = "var a = new RegExp(c, 'i')";
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [
     { code: "var a = new RegExp('ab+c', 'i')" },
     {

package/test/{detect-non-literal-require.js → rules/detect-non-literal-require.js}

@@ -6,7 +6,7 @@ const tester = new RuleTester({ parserOptions: { ecmaVersion: 6 } });
 
 const ruleName = 'detect-non-literal-require';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [
     { code: "var a = require('b')" },
     { code: 'var a = require(`b`)' },

package/test/{detect-object-injection.js → rules/detect-object-injection.js}

@@ -5,7 +5,7 @@ const tester = new RuleTester();
 
 const ruleName = 'detect-object-injection';
 
-const Rule = require(`../rules/${ruleName}`);
+const Rule = require(`../../rules/${ruleName}`);
 
 const valid = 'var a = {};';
 // const invalidVariable = "TODO";

package/test/{detect-possible-timing-attacks.js → rules/detect-possible-timing-attacks.js}

@@ -4,7 +4,7 @@ const RuleTester = require('eslint').RuleTester;
 const tester = new RuleTester();
 
 const ruleName = 'detect-possible-timing-attacks';
-const Rule = require(`../rules/${ruleName}`);
+const Rule = require(`../../rules/${ruleName}`);
 
 const valid = 'if (age === 5) {}';
 const invalidLeft = "if (password === 'mypass') {}";

package/test/{detect-pseudoRandomBytes.js → rules/detect-pseudoRandomBytes.js}

@@ -6,7 +6,7 @@ const tester = new RuleTester();
 const ruleName = 'detect-pseudoRandomBytes';
 const invalid = 'crypto.pseudoRandomBytes';
 
-tester.run(ruleName, require(`../rules/${ruleName}`), {
+tester.run(ruleName, require(`../../rules/${ruleName}`), {
   valid: [{ code: 'crypto.randomBytes' }],
   invalid: [
     {

package/test/{detect-unsafe-regexp.js → rules/detect-unsafe-regexp.js}

@@ -4,7 +4,7 @@ const RuleTester = require('eslint').RuleTester;
 const tester = new RuleTester();
 
 const ruleName = 'detect-unsafe-regex';
-const Rule = require(`../rules/${ruleName}`);
+const Rule = require(`../../rules/${ruleName}`);
 
 tester.run(ruleName, Rule, {
   valid: [{ code: '/^d+1337d+$/' }],