eslint-plugin-security 4.0.0 → 4.0.1

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "4.0.0"
+    ".": "4.0.1"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.0.1](https://github.com/eslint-community/eslint-plugin-security/compare/eslint-plugin-security-v4.0.0...eslint-plugin-security-v4.0.1) (2026-06-12)
+
+
+### Bug Fixes
+
+* treat import.meta.dirname and import.meta.filename as static ([#200](https://github.com/eslint-community/eslint-plugin-security/issues/200)) ([74c97bb](https://github.com/eslint-community/eslint-plugin-security/commit/74c97bb3326a6b4fe4718b2638bb3b0492cb90fd))
+
 ## [4.0.0](https://github.com/eslint-community/eslint-plugin-security/compare/eslint-plugin-security-v3.0.1...eslint-plugin-security-v4.0.0) (2026-02-19)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-security",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Security rules for eslint",
   "main": "index.js",
   "type": "commonjs",

package/test/rules/detect-non-literal-fs-filename.js

@@ -62,6 +62,13 @@ tester.run(ruleName, require(`../../rules/${ruleName}`), {
     import url from 'url';
     const dirname = path.dirname(url.fileURLToPath(import.meta.url));
     const html = fs.readFileSync(path.resolve(dirname, './index.html'), 'utf-8');`,
+    `
+    import fs from 'fs';
+    import path from 'path';
+    const html = fs.readFileSync(path.resolve(import.meta.dirname, './index.html'), 'utf-8');`,
+    `
+    import fs from 'fs';
+    const pkg = fs.readFileSync(import.meta.filename, 'utf-8');`,
     {
       code: `
       import fs from 'fs';
@@ -201,5 +208,12 @@ tester.run(ruleName, require(`../../rules/${ruleName}`), {
       },
       errors: [{ message: 'Found readFileSync from package "fs" with non literal argument at index 0' }],
     },
+    {
+      code: `
+            import fs from 'fs';
+            import path from 'path';
+            const key = fs.readFileSync(path.resolve(import.meta[prop], './index.html'));`,
+      errors: [{ message: 'Found readFileSync from package "fs" with non literal argument at index 0' }],
+    },
   ],
 });

package/test/utils/is-static-expression.js

@@ -253,6 +253,20 @@ describe('isStaticExpression', () => {
         `,
         result: [true, false],
       },
+      {
+        code: `
+        target(import.meta.dirname);
+        target(import.meta.filename);
+        `,
+        result: [true, true],
+      },
+      {
+        code: `
+        target(import.meta[prop]);
+        target(import.meta.resolve('static'));
+        `,
+        result: [false, false],
+      },
     ]) {
       it(code, () => {
         deepStrictEqual(getIsStaticExpressionResult(code), result);

package/utils/is-static-expression.js

@@ -7,6 +7,7 @@ const PATH_PACKAGE_NAMES = ['path', 'node:path', 'path/posix', 'node:path/posix'
 const URL_PACKAGE_NAMES = ['url', 'node:url'];
 const PATH_CONSTRUCTION_METHOD_NAMES = new Set(['basename', 'dirname', 'extname', 'join', 'normalize', 'relative', 'resolve', 'toNamespacedPath']);
 const PATH_STATIC_MEMBER_NAMES = new Set(['delimiter', 'sep']);
+const IMPORT_META_STATIC_PROPERTY_NAMES = new Set(['url', 'dirname', 'filename']);
 
 /**
  * @type {WeakMap<import("estree").Expression, boolean>}
@@ -83,7 +84,7 @@ function isStaticExpression({ node, scope }) {
         return false;
       }
     }
-    return isStaticPath(node) || isStaticFileURLToPath(node) || isStaticImportMetaUrl(node) || isStaticRequireResolve(node) || isStaticCwd(node);
+    return isStaticPath(node) || isStaticFileURLToPath(node) || isStaticImportMetaProperty(node) || isStaticRequireResolve(node) || isStaticCwd(node);
   }
 
   /**
@@ -150,17 +151,21 @@ function isStaticExpression({ node, scope }) {
   }
 
   /**
-   * Checks whether the given expression is an `import.meta.url`.
+   * Checks whether the given expression is a static `import.meta` property,
+   * i.e. `import.meta.url`, `import.meta.dirname`, or `import.meta.filename`.
+   *
+   * `import.meta.dirname` and `import.meta.filename` are available in Node.js
+   * 20.11.0+ / 21.2.0+ and resolve to constant values for a given module.
    *
    * @param {import("estree").Expression} node The node to check.
-   * @returns {boolean} if true, the given expression is an `import.meta.url`.
+   * @returns {boolean} if true, the given expression is a static `import.meta` property.
    */
-  function isStaticImportMetaUrl(node) {
+  function isStaticImportMetaProperty(node) {
     return (
       node.type === 'MemberExpression' &&
       !node.computed &&
       node.property.type === 'Identifier' &&
-      node.property.name === 'url' &&
+      IMPORT_META_STATIC_PROPERTY_NAMES.has(node.property.name) &&
       node.object.type === 'MetaProperty' &&
       node.object.meta.name === 'import' &&
       node.object.property.name === 'meta'