eslint-plugin-security 3.0.1 → 4.0.1

package/.eslint-doc-generatorrc.js

@@ -1,3 +1,5 @@
+'use strict';
+
 const { format } = require('prettier');
 const prettierRC = require('./.prettierrc.json');
 

package/.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        node: [18.18.0, 18.x, 20.x, 21.x]
+        node: [18.18.0, 18.x, 20.x, 22.x, 24.x]
         include:
           - os: windows-latest
             node: lts/*

package/.github/workflows/pr.yml

@@ -8,10 +8,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
       - uses: beemojs/conventional-pr-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/.github/workflows/release-please.yml

@@ -2,38 +2,46 @@ on:
   push:
     branches:
       - main
+
 name: release-please
+
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+      models: read
     steps:
-      - uses: GoogleCloudPlatform/release-please-action@v2
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
-        with:
-          release-type: node
-          package-name: test-release-please
-      # The logic below handles the npm publication:
-      - uses: actions/checkout@v3
-        # these if statements ensure that a publication only occurs when
-        # a new release is created:
+
+      - uses: actions/checkout@v6
         if: ${{ steps.release.outputs.release_created }}
-      - uses: actions/setup-node@v3
+
+      - uses: actions/setup-node@v6
         with:
-          node-version: 16
-          registry-url: 'https://registry.npmjs.org'
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
         if: ${{ steps.release.outputs.release_created }}
-      - run: npm ci
+
+        # npm 11.5.1 or later is required so update to latest to be sure
+      - name: Update npm
+        run: npm install -g npm@latest
         if: ${{ steps.release.outputs.release_created }}
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+
+      - name: Publish to npm
+        run: |
+          npm install
+          npm publish --access public
         if: ${{ steps.release.outputs.release_created }}
 
       # Tweets out release announcement
-      - run: 'npx @humanwhocodes/tweet "${{ github.event.repository.full_name }} v${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }} has been released!\n\n${{ github.event.repository.html_url }}/releases/tag/v${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}"'
-        if: ${{ steps.release.outputs.release_created }}
+      - run: 'npx @humanwhocodes/tweet "${{ github.event.repository.full_name }} v${{ needs.release-please.outputs.major }}.${{ needs.release-please.outputs.minor }}.${{ needs.release-please.outputs.patch }} has been released!\n\n${{ github.event.repository.html_url }}/releases/tag/v${{ needs.release-please.outputs.major }}.${{ needs.release-please.outputs.minor }}.${{ needs.release-please.outputs.patch }}"'
         env:
           TWITTER_CONSUMER_KEY: ${{ secrets.TWITTER_CONSUMER_KEY }}
           TWITTER_CONSUMER_SECRET: ${{ secrets.TWITTER_CONSUMER_SECRET }}
           TWITTER_ACCESS_TOKEN_KEY: ${{ secrets.TWITTER_ACCESS_TOKEN_KEY }}
           TWITTER_ACCESS_TOKEN_SECRET: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}
+        if: ${{ steps.release.outputs.release_created }}

package/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+    ".": "4.0.1"
+}

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## [4.0.1](https://github.com/eslint-community/eslint-plugin-security/compare/eslint-plugin-security-v4.0.0...eslint-plugin-security-v4.0.1) (2026-06-12)
+
+
+### Bug Fixes
+
+* treat import.meta.dirname and import.meta.filename as static ([#200](https://github.com/eslint-community/eslint-plugin-security/issues/200)) ([74c97bb](https://github.com/eslint-community/eslint-plugin-security/commit/74c97bb3326a6b4fe4718b2638bb3b0492cb90fd))
+
+## [4.0.0](https://github.com/eslint-community/eslint-plugin-security/compare/eslint-plugin-security-v3.0.1...eslint-plugin-security-v4.0.0) (2026-02-19)
+
+
+### ⚠ BREAKING CHANGES
+
+* requires node ^18.18.0 || ^20.9.0 || >=21.1.0 ([#146](https://github.com/eslint-community/eslint-plugin-security/issues/146))
+* switch the recommended config to flat ([#118](https://github.com/eslint-community/eslint-plugin-security/issues/118))
+
+### Features
+
+* add config recommended-legacy ([#132](https://github.com/eslint-community/eslint-plugin-security/issues/132)) ([13d3f2f](https://github.com/eslint-community/eslint-plugin-security/commit/13d3f2fc6ba327c894959db30462f3fda0272f0c))
+* Add meta object documentation for all rules ([#79](https://github.com/eslint-community/eslint-plugin-security/issues/79)) ([fb1d9ef](https://github.com/eslint-community/eslint-plugin-security/commit/fb1d9ef56e0cf2705b9e413b483261df394c45e1))
+* detect-bidi-characters rule ([#95](https://github.com/eslint-community/eslint-plugin-security/issues/95)) ([4294d29](https://github.com/eslint-community/eslint-plugin-security/commit/4294d29cca8af5c627de759919add6dd698644ba))
+* **detect-non-literal-fs-filename:** change to track non-top-level `require()` as well ([#105](https://github.com/eslint-community/eslint-plugin-security/issues/105)) ([d3b1543](https://github.com/eslint-community/eslint-plugin-security/commit/d3b15435b45b9ac2ee5f0d3249f590e32369d7d2))
+* extend detect non literal fs filename ([#92](https://github.com/eslint-community/eslint-plugin-security/issues/92)) ([08ba476](https://github.com/eslint-community/eslint-plugin-security/commit/08ba4764a83761f6f44cb28940923f1d25f88581))
+* improve detect-child-process rule ([#108](https://github.com/eslint-community/eslint-plugin-security/issues/108)) ([64ae529](https://github.com/eslint-community/eslint-plugin-security/commit/64ae52944a86f9d9daee769acd63ebbdfc5b6631))
+* **non-literal-require:** support template literals ([#81](https://github.com/eslint-community/eslint-plugin-security/issues/81)) ([208019b](https://github.com/eslint-community/eslint-plugin-security/commit/208019bad4f70a142ab1f0ea7238c37cb70d1a5a))
+* requires node ^18.18.0 || ^20.9.0 || >=21.1.0 ([#146](https://github.com/eslint-community/eslint-plugin-security/issues/146)) ([df1b606](https://github.com/eslint-community/eslint-plugin-security/commit/df1b6063c1224e1163dfdc37c96b64bb52d816bb))
+* switch the recommended config to flat ([#118](https://github.com/eslint-community/eslint-plugin-security/issues/118)) ([e20a366](https://github.com/eslint-community/eslint-plugin-security/commit/e20a3664c2f638466286ae9a97515722fc98f97c))
+
+
+### Bug Fixes
+
+* Add ESLint 10 compatibility for context.sourceCode API change ([#186](https://github.com/eslint-community/eslint-plugin-security/issues/186)) ([7f9ee77](https://github.com/eslint-community/eslint-plugin-security/commit/7f9ee77677744f7029c545d714d57f0966b3387e))
+* add name to recommended flat config ([#161](https://github.com/eslint-community/eslint-plugin-security/issues/161)) ([aa1c8c5](https://github.com/eslint-community/eslint-plugin-security/commit/aa1c8c57a2df4ce64a202808c5642a41b47d4519))
+* Avoid crash when exec() is passed no arguments ([7f97815](https://github.com/eslint-community/eslint-plugin-security/commit/7f97815accf6bcd87de73c32a967946b1b3b0530)), closes [#82](https://github.com/eslint-community/eslint-plugin-security/issues/82) [#23](https://github.com/eslint-community/eslint-plugin-security/issues/23)
+* Avoid TypeError when exec stub is used with no arguments ([#97](https://github.com/eslint-community/eslint-plugin-security/issues/97)) ([9c18f16](https://github.com/eslint-community/eslint-plugin-security/commit/9c18f16187719b58cc5dfde9860344bad823db28))
+* **detect-child-process:** false positive for destructuring with `exec` ([#102](https://github.com/eslint-community/eslint-plugin-security/issues/102)) ([657921a](https://github.com/eslint-community/eslint-plugin-security/commit/657921a93f6f73c0de6113e497b22e7cf079f520))
+* **detect-child-process:** false positives for destructuring `spawn` ([#103](https://github.com/eslint-community/eslint-plugin-security/issues/103)) ([fdfe37d](https://github.com/eslint-community/eslint-plugin-security/commit/fdfe37d667367e5fd228c26573a1791c81a044d2))
+* Ensure empty eval() doesn't crash detect-eval-with-expression ([#139](https://github.com/eslint-community/eslint-plugin-security/issues/139)) ([8a7c7db](https://github.com/eslint-community/eslint-plugin-security/commit/8a7c7db1e2b49e2831d510b8dc1db235dee0edf0))
+* Ensure everything works with ESLint v9 ([#145](https://github.com/eslint-community/eslint-plugin-security/issues/145)) ([ac50ab4](https://github.com/eslint-community/eslint-plugin-security/commit/ac50ab481ed63d7262513186136ca1429d3b8290))
+* false positives for static expressions in detect-non-literal-fs-filename, detect-child-process, detect-non-literal-regexp, and detect-non-literal-require ([#109](https://github.com/eslint-community/eslint-plugin-security/issues/109)) ([56102b5](https://github.com/eslint-community/eslint-plugin-security/commit/56102b50aed4bd632dd668770eb37de58788110b))
+* generate provenance statement for release ([#168](https://github.com/eslint-community/eslint-plugin-security/issues/168)) ([eb3ee9c](https://github.com/eslint-community/eslint-plugin-security/commit/eb3ee9c38cfd51e13c7a4061f5794db7347c90e5))
+* Incorrect method name in detect-buffer-noassert. ([313c0c6](https://github.com/eslint-community/eslint-plugin-security/commit/313c0c693f48aa85d0c9b65a46f6c620cd10f907)), closes [#63](https://github.com/eslint-community/eslint-plugin-security/issues/63) [#80](https://github.com/eslint-community/eslint-plugin-security/issues/80)
+* release-please config ([#189](https://github.com/eslint-community/eslint-plugin-security/issues/189)) ([2443d10](https://github.com/eslint-community/eslint-plugin-security/commit/2443d10c428724757fac230384ff0692bbd50485))
+
+### [3.0.1](https://www.github.com/eslint-community/eslint-plugin-security/compare/v3.0.0...v3.0.1) (2024-06-14)
+
+
+### Bug Fixes
+
+* add name to recommended flat config ([#161](https://www.github.com/eslint-community/eslint-plugin-security/issues/161)) ([aa1c8c5](https://www.github.com/eslint-community/eslint-plugin-security/commit/aa1c8c57a2df4ce64a202808c5642a41b47d4519))
+
 ### [3.0.1](https://www.github.com/eslint-community/eslint-plugin-security/compare/v3.0.0...v3.0.1) (2024-06-13)
 
 

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "eslint-plugin-security",
-  "version": "3.0.1",
+  "version": "4.0.1",
   "description": "Security rules for eslint",
   "main": "index.js",
+  "type": "commonjs",
   "scripts": {
     "changelog": "changelog eslint-plugin-security all > CHANGELOG.md",
     "cont-int": "npm test && npm run lint",
@@ -55,7 +56,7 @@
     "eslint-plugin-eslint-plugin": "^5.5.1",
     "lint-staged": "^12.3.7",
     "markdownlint-cli": "^0.32.2",
-    "mocha": "^9.2.2",
+    "mocha": "^11.7.5",
     "npm-run-all": "^4.1.5",
     "prettier": "^2.6.2",
     "semantic-release": "^19.0.2",

package/release-please-config.json

@@ -0,0 +1,9 @@
+{
+    "bump-minor-pre-major": true,
+    "packages": {
+        ".": {
+            "release-type": "node",
+            "pull-request-title-pattern": "chore: release ${version} 🚀"
+        }
+    }
+}

package/rules/detect-no-csrf-before-method-override.js

@@ -20,11 +20,12 @@ module.exports = {
     },
   },
   create(context) {
+    const sourceCode = context.sourceCode || context.getSourceCode();
     let csrf = false;
 
     return {
       CallExpression: function (node) {
-        const token = context.getSourceCode().getTokens(node)[0];
+        const token = sourceCode.getTokens(node)[0];
         const nodeValue = token.value;
 
         if (nodeValue === 'express') {

package/rules/detect-unsafe-regex.js

@@ -26,9 +26,10 @@ module.exports = {
     },
   },
   create(context) {
+    const sourceCode = context.sourceCode || context.getSourceCode();
     return {
       Literal: function (node) {
-        const token = context.getSourceCode().getTokens(node)[0];
+        const token = sourceCode.getTokens(node)[0];
         const nodeType = token.type;
         const nodeValue = token.value;
 

package/test/rules/detect-non-literal-fs-filename.js

@@ -62,6 +62,13 @@ tester.run(ruleName, require(`../../rules/${ruleName}`), {
     import url from 'url';
     const dirname = path.dirname(url.fileURLToPath(import.meta.url));
     const html = fs.readFileSync(path.resolve(dirname, './index.html'), 'utf-8');`,
+    `
+    import fs from 'fs';
+    import path from 'path';
+    const html = fs.readFileSync(path.resolve(import.meta.dirname, './index.html'), 'utf-8');`,
+    `
+    import fs from 'fs';
+    const pkg = fs.readFileSync(import.meta.filename, 'utf-8');`,
     {
       code: `
       import fs from 'fs';
@@ -201,5 +208,12 @@ tester.run(ruleName, require(`../../rules/${ruleName}`), {
       },
       errors: [{ message: 'Found readFileSync from package "fs" with non literal argument at index 0' }],
     },
+    {
+      code: `
+            import fs from 'fs';
+            import path from 'path';
+            const key = fs.readFileSync(path.resolve(import.meta[prop], './index.html'));`,
+      errors: [{ message: 'Found readFileSync from package "fs" with non literal argument at index 0' }],
+    },
   ],
 });

package/test/utils/is-static-expression.js

@@ -253,6 +253,20 @@ describe('isStaticExpression', () => {
         `,
         result: [true, false],
       },
+      {
+        code: `
+        target(import.meta.dirname);
+        target(import.meta.filename);
+        `,
+        result: [true, true],
+      },
+      {
+        code: `
+        target(import.meta[prop]);
+        target(import.meta.resolve('static'));
+        `,
+        result: [false, false],
+      },
     ]) {
       it(code, () => {
         deepStrictEqual(getIsStaticExpressionResult(code), result);

package/utils/is-static-expression.js

@@ -7,6 +7,7 @@ const PATH_PACKAGE_NAMES = ['path', 'node:path', 'path/posix', 'node:path/posix'
 const URL_PACKAGE_NAMES = ['url', 'node:url'];
 const PATH_CONSTRUCTION_METHOD_NAMES = new Set(['basename', 'dirname', 'extname', 'join', 'normalize', 'relative', 'resolve', 'toNamespacedPath']);
 const PATH_STATIC_MEMBER_NAMES = new Set(['delimiter', 'sep']);
+const IMPORT_META_STATIC_PROPERTY_NAMES = new Set(['url', 'dirname', 'filename']);
 
 /**
  * @type {WeakMap<import("estree").Expression, boolean>}
@@ -83,7 +84,7 @@ function isStaticExpression({ node, scope }) {
         return false;
       }
     }
-    return isStaticPath(node) || isStaticFileURLToPath(node) || isStaticImportMetaUrl(node) || isStaticRequireResolve(node) || isStaticCwd(node);
+    return isStaticPath(node) || isStaticFileURLToPath(node) || isStaticImportMetaProperty(node) || isStaticRequireResolve(node) || isStaticCwd(node);
   }
 
   /**
@@ -150,17 +151,21 @@ function isStaticExpression({ node, scope }) {
   }
 
   /**
-   * Checks whether the given expression is an `import.meta.url`.
+   * Checks whether the given expression is a static `import.meta` property,
+   * i.e. `import.meta.url`, `import.meta.dirname`, or `import.meta.filename`.
+   *
+   * `import.meta.dirname` and `import.meta.filename` are available in Node.js
+   * 20.11.0+ / 21.2.0+ and resolve to constant values for a given module.
    *
    * @param {import("estree").Expression} node The node to check.
-   * @returns {boolean} if true, the given expression is an `import.meta.url`.
+   * @returns {boolean} if true, the given expression is a static `import.meta` property.
    */
-  function isStaticImportMetaUrl(node) {
+  function isStaticImportMetaProperty(node) {
     return (
       node.type === 'MemberExpression' &&
       !node.computed &&
       node.property.type === 'Identifier' &&
-      node.property.name === 'url' &&
+      IMPORT_META_STATIC_PROPERTY_NAMES.has(node.property.name) &&
       node.object.type === 'MetaProperty' &&
       node.object.meta.name === 'import' &&
       node.object.property.name === 'meta'