eslint-plugin-sonarjs 1.0.4 → 2.0.0

package/lib/S6281/rule.js

@@ -0,0 +1,109 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S6281/javascript
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const helpers_1 = require("../helpers");
+const meta_json_1 = __importDefault(require("./meta.json"));
+const BLOCK_PUBLIC_ACCESS_KEY = 'blockPublicAccess';
+const BLOCK_PUBLIC_ACCESS_PROPERTY_KEYS = [
+    'blockPublicAcls',
+    'blockPublicPolicy',
+    'ignorePublicAcls',
+    'restrictPublicBuckets',
+];
+const messages = {
+    omitted: 'No Public Access Block configuration prevents public ACL/policies ' +
+        'to be set on this S3 bucket. Make sure it is safe here.',
+    public: 'Make sure allowing public ACL/policies to be set is safe here.',
+};
+exports.rule = (0, helpers_1.S3BucketTemplate)((bucket, context) => {
+    const blockPublicAccess = (0, helpers_1.getBucketProperty)(context, bucket, BLOCK_PUBLIC_ACCESS_KEY);
+    if (blockPublicAccess == null) {
+        (0, helpers_1.report)(context, {
+            message: messages['omitted'],
+            node: bucket.callee,
+        });
+    }
+    else {
+        checkBlockPublicAccessValue(blockPublicAccess);
+        checkBlockPublicAccessConstructor(blockPublicAccess);
+    }
+    /** Checks `blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS` sensitive pattern */
+    function checkBlockPublicAccessValue(blockPublicAccess) {
+        const blockPublicAccessMember = (0, helpers_1.getValueOfExpression)(context, blockPublicAccess.value, 'MemberExpression');
+        if (blockPublicAccessMember !== undefined &&
+            (0, helpers_1.normalizeFQN)((0, helpers_1.getFullyQualifiedName)(context, blockPublicAccessMember)) ===
+                'aws_cdk_lib.aws_s3.BlockPublicAccess.BLOCK_ACLS') {
+            const propagated = (0, helpers_1.findPropagatedSetting)(blockPublicAccess, blockPublicAccessMember);
+            (0, helpers_1.report)(context, {
+                message: messages['public'],
+                node: blockPublicAccess,
+            }, propagated ? [propagated] : []);
+        }
+    }
+    /** Checks `blockPublicAccess: new s3.BlockPublicAccess({...})` sensitive pattern */
+    function checkBlockPublicAccessConstructor(blockPublicAccess) {
+        const blockPublicAccessNew = (0, helpers_1.getValueOfExpression)(context, blockPublicAccess.value, 'NewExpression');
+        if (blockPublicAccessNew !== undefined &&
+            isS3BlockPublicAccessConstructor(blockPublicAccessNew)) {
+            const blockPublicAccessConfig = (0, helpers_1.getValueOfExpression)(context, blockPublicAccessNew.arguments[0], 'ObjectExpression');
+            if (blockPublicAccessConfig === undefined) {
+                (0, helpers_1.report)(context, {
+                    message: messages['omitted'],
+                    node: blockPublicAccessNew,
+                });
+            }
+            else {
+                BLOCK_PUBLIC_ACCESS_PROPERTY_KEYS.forEach(key => checkBlockPublicAccessConstructorProperty(blockPublicAccessConfig, key));
+            }
+        }
+        function checkBlockPublicAccessConstructorProperty(blockPublicAccessConfig, key) {
+            const blockPublicAccessProperty = blockPublicAccessConfig.properties.find(property => (0, helpers_1.isProperty)(property) && (0, helpers_1.isIdentifier)(property.key, key));
+            if (blockPublicAccessProperty !== undefined) {
+                const blockPublicAccessValue = (0, helpers_1.getValueOfExpression)(context, blockPublicAccessProperty.value, 'Literal');
+                if (blockPublicAccessValue?.value === false) {
+                    const propagated = (0, helpers_1.findPropagatedSetting)(blockPublicAccessProperty, blockPublicAccessValue);
+                    (0, helpers_1.report)(context, {
+                        message: messages['public'],
+                        node: blockPublicAccessProperty,
+                    }, propagated ? [propagated] : []);
+                }
+            }
+        }
+        function isS3BlockPublicAccessConstructor(expr) {
+            return (expr.callee.type === 'MemberExpression' &&
+                (0, helpers_1.normalizeFQN)((0, helpers_1.getFullyQualifiedName)(context, expr.callee)) ===
+                    'aws_cdk_lib.aws_s3.BlockPublicAccess');
+        }
+    }
+}, (0, helpers_1.generateMeta)(meta_json_1.default, {
+    schema: [
+        {
+            // internal parameter for rules having secondary locations
+            enum: [helpers_1.SONAR_RUNTIME],
+        },
+    ],
+}));
+//# sourceMappingURL=rule.js.map

package/lib/S6281/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../S6281/rule.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAA+D;;;;;;AAI/D,wCAYoB;AACpB,4DAAoC;AAEpC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AACpD,MAAM,iCAAiC,GAAG;IACxC,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,uBAAuB;CACxB,CAAC;AAEF,MAAM,QAAQ,GAAG;IACf,OAAO,EACL,oEAAoE;QACpE,yDAAyD;IAC3D,MAAM,EAAE,gEAAgE;CACzE,CAAC;AAEW,QAAA,IAAI,GAAoB,IAAA,0BAAgB,EACnD,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAClB,MAAM,iBAAiB,GAAG,IAAA,2BAAiB,EAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACtF,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAA,gBAAM,EAAC,OAAO,EAAE;YACd,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;YAC5B,IAAI,EAAE,MAAM,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QAC/C,iCAAiC,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAED,oFAAoF;IACpF,SAAS,2BAA2B,CAAC,iBAA2B;QAC9D,MAAM,uBAAuB,GAAG,IAAA,8BAAoB,EAClD,OAAO,EACP,iBAAiB,CAAC,KAAK,EACvB,kBAAkB,CACnB,CAAC;QACF,IACE,uBAAuB,KAAK,SAAS;YACrC,IAAA,sBAAY,EAAC,IAAA,+BAAqB,EAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;gBACnE,iDAAiD,EACnD,CAAC;YACD,MAAM,UAAU,GAAG,IAAA,+BAAqB,EAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;YACrF,IAAA,gBAAM,EACJ,OAAO,EACP;gBACE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,IAAI,EAAE,iBAAiB;aACxB,EACD,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,SAAS,iCAAiC,CAAC,iBAA2B;QACpE,MAAM,oBAAoB,GAAG,IAAA,8BAAoB,EAC/C,OAAO,EACP,iBAAiB,CAAC,KAAK,EACvB,eAAe,CAChB,CAAC;QACF,IACE,oBAAoB,KAAK,SAAS;YAClC,gCAAgC,CAAC,oBAAoB,CAAC,EACtD,CAAC;YACD,MAAM,uBAAuB,GAAG,IAAA,8BAAoB,EAClD,OAAO,EACP,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,EACjC,kBAAkB,CACnB,CAAC;YACF,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,IAAA,gBAAM,EAAC,OAAO,EAAE;oBACd,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;oBAC5B,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iCAAiC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC9C,yCAAyC,CAAC,uBAAuB,EAAE,GAAG,CAAC,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,SAAS,yCAAyC,CAChD,uBAAyC,EACzC,GAAW;YAEX,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CACvE,QAAQ,CAAC,EAAE,CAAC,IAAA,oBAAU,EAAC,QAAQ,CAAC,IAAI,IAAA,sBAAY,EAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAC5C,CAAC;YAC1B,IAAI,yBAAyB,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,sBAAsB,GAAG,IAAA,8BAAoB,EACjD,OAAO,EACP,yBAAyB,CAAC,KAAK,EAC/B,SAAS,CACV,CAAC;gBACF,IAAI,sBAAsB,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC5C,MAAM,UAAU,GAAG,IAAA,+BAAqB,EACtC,yBAAyB,EACzB,sBAAsB,CACvB,CAAC;oBACF,IAAA,gBAAM,EACJ,OAAO,EACP;wBACE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;wBAC3B,IAAI,EAAE,yBAAyB;qBAChC,EACD,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,gCAAgC,CAAC,IAAmB;YAC3D,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAA,sBAAY,EAAC,IAAA,+BAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvD,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,EACD,IAAA,sBAAY,EAAC,mBAA8B,EAAE;IAC3C,MAAM,EAAE;QACN;YACE,0DAA0D;YAC1D,IAAI,EAAE,CAAC,uBAAa,CAAC;SACtB;KACF;CACF,CAAC,CACH,CAAC"}

package/lib/S6299/index.d.ts

@@ -0,0 +1 @@
+export { rule } from './rule';

package/lib/S6299/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+var rule_1 = require("./rule");
+Object.defineProperty(exports, "rule", { enumerable: true, get: function () { return rule_1.rule; } });
+//# sourceMappingURL=index.js.map

package/lib/S6299/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../S6299/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+BAA8B;AAArB,4FAAA,IAAI,OAAA"}

package/lib/S6299/meta.json

@@ -0,0 +1,9 @@
+{
+    "type": "problem",
+    "docs": {
+        "description": "Disabling Vue.js built-in escaping is security-sensitive",
+        "recommended": true,
+        "url": "https://sonarsource.github.io/rspec/#/rspec/S6299/javascript",
+        "requiresTypeChecking": false
+    }
+}

package/lib/S6299/rule.d.ts

@@ -0,0 +1,2 @@
+import { Rule } from 'eslint';
+export declare const rule: Rule.RuleModule;

package/lib/S6299/rule.js

@@ -0,0 +1,67 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S6299/javascript
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const helpers_1 = require("../helpers");
+const meta_json_1 = __importDefault(require("./meta.json"));
+exports.rule = {
+    meta: (0, helpers_1.generateMeta)(meta_json_1.default, {
+        messages: {
+            safeVueBypassing: 'Make sure bypassing Vue built-in sanitization is safe here.',
+        },
+    }),
+    create(context) {
+        const services = context.sourceCode.parserServices;
+        function attrsHref(calleeName) {
+            // select call expression with given name where second argument is object expression like { attrs: { href: 'bla' } }
+            return `CallExpression[callee.name='${calleeName}'] ObjectExpression.arguments:nth-child(2) > Property[key.name='attrs'] > ObjectExpression.value > Property[key.name='href']`;
+        }
+        const ruleListener = {
+            ["JSXAttribute[name.name='domPropsInnerHTML']," +
+                "Property[key.name='domProps'] > ObjectExpression.value > Property[key.name='innerHTML']"](node) {
+                context.report({ node, messageId: 'safeVueBypassing' });
+            },
+            [`${attrsHref('createElement')},${attrsHref('h')}`](node) {
+                context.report({ node, messageId: 'safeVueBypassing' });
+            },
+        };
+        // @ts-ignore
+        if (services.defineTemplateBodyVisitor) {
+            // analyze <template> in .vue file
+            const templateBodyVisitor = context.sourceCode.parserServices.defineTemplateBodyVisitor({
+                ["VAttribute[directive=true][key.name.name='html']," +
+                    "VAttribute[directive=true][key.argument.name='href']"](node) {
+                    context.report({
+                        loc: node.loc,
+                        messageId: 'safeVueBypassing',
+                    });
+                },
+            });
+            Object.assign(ruleListener, templateBodyVisitor);
+        }
+        return ruleListener;
+    },
+};
+//# sourceMappingURL=rule.js.map

package/lib/S6299/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../S6299/rule.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAA+D;;;;;;AAK/D,wCAA0C;AAC1C,4DAAoC;AAEvB,QAAA,IAAI,GAAoB;IACnC,IAAI,EAAE,IAAA,sBAAY,EAAC,mBAA8B,EAAE;QACjD,QAAQ,EAAE;YACR,gBAAgB,EAAE,6DAA6D;SAChF;KACF,CAAC;IACF,MAAM,CAAC,OAAyB;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;QAEnD,SAAS,SAAS,CAAC,UAAkB;YACnC,oHAAoH;YACpH,OAAO,+BAA+B,UAAU,8HAA8H,CAAC;QACjL,CAAC;QAED,MAAM,YAAY,GAAsB;YACtC,CAAC,8CAA8C;gBAC7C,yFAAyF,CAAC,CAC1F,IAAiB;gBAEjB,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAiB;gBACnE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC1D,CAAC;SACF,CAAC;QAEF,aAAa;QACb,IAAI,QAAQ,CAAC,yBAAyB,EAAE,CAAC;YACvC,kCAAkC;YAClC,MAAM,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,yBAAyB,CAAC;gBACtF,CAAC,mDAAmD;oBAClD,sDAAsD,CAAC,CAAC,IAAoB;oBAC5E,OAAO,CAAC,MAAM,CAAC;wBACb,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,SAAS,EAAE,kBAAkB;qBAC9B,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF,CAAC"}

package/lib/S6302/index.d.ts

@@ -0,0 +1 @@
+export { rule } from './rule';

package/lib/S6302/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+var rule_1 = require("./rule");
+Object.defineProperty(exports, "rule", { enumerable: true, get: function () { return rule_1.rule; } });
+//# sourceMappingURL=index.js.map

package/lib/S6302/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../S6302/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+BAA8B;AAArB,4FAAA,IAAI,OAAA"}

package/lib/S6302/meta.json

@@ -0,0 +1,9 @@
+{
+    "type": "problem",
+    "docs": {
+        "description": "Policies granting all privileges are security-sensitive",
+        "recommended": true,
+        "url": "https://sonarsource.github.io/rspec/#/rspec/S6302/javascript",
+        "requiresTypeChecking": false
+    }
+}

package/lib/S6302/rule.d.ts

@@ -0,0 +1,2 @@
+import { Rule } from 'eslint';
+export declare const rule: Rule.RuleModule;

package/lib/S6302/rule.js

@@ -0,0 +1,66 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S6302/javascript
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const result_1 = require("../helpers/result");
+const iam_1 = require("../helpers/aws/iam");
+const helpers_1 = require("../helpers");
+const meta_json_1 = __importDefault(require("./meta.json"));
+const MESSAGES = {
+    message: 'Make sure granting all privileges is safe here.',
+    secondary: 'Related effect',
+};
+exports.rule = (0, iam_1.AwsIamPolicyTemplate)(allPrivilegesStatementChecker, (0, helpers_1.generateMeta)(meta_json_1.default, {
+    schema: [
+        {
+            // internal parameter for rules having secondary locations
+            enum: [helpers_1.SONAR_RUNTIME],
+        },
+    ],
+}));
+function allPrivilegesStatementChecker(expr, ctx, options) {
+    const properties = (0, result_1.getResultOfExpression)(ctx, expr);
+    const effect = (0, iam_1.getSensitiveEffect)(properties, ctx, options);
+    const action = getSensitiveAction(properties, options);
+    if (effect.isMissing && action) {
+        (0, helpers_1.report)(ctx, {
+            message: MESSAGES.message,
+            node: action,
+        });
+    }
+    else if (effect.isFound && action) {
+        (0, helpers_1.report)(ctx, {
+            message: MESSAGES.message,
+            node: action,
+        }, [(0, helpers_1.toSecondaryLocation)(effect.node, MESSAGES.secondary)]);
+    }
+}
+function getSensitiveAction(properties, options) {
+    return getActionLiterals(properties, options).find(iam_1.isAnyLiteral);
+}
+function getActionLiterals(properties, options) {
+    return properties.getProperty(options.actions.property).asStringLiterals();
+}
+//# sourceMappingURL=rule.js.map

package/lib/S6302/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../S6302/rule.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAA+D;;;;;;AAI/D,8CAAkE;AAClE,4CAK4B;AAC5B,wCAAsF;AACtF,4DAAoC;AAEpC,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,iDAAiD;IAC1D,SAAS,EAAE,gBAAgB;CAC5B,CAAC;AAEW,QAAA,IAAI,GAAoB,IAAA,0BAAoB,EACvD,6BAA6B,EAC7B,IAAA,sBAAY,EAAC,mBAA8B,EAAE;IAC3C,MAAM,EAAE;QACN;YACE,0DAA0D;YAC1D,IAAI,EAAE,CAAC,uBAAa,CAAC;SACtB;KACF;CACF,CAAC,CACH,CAAC;AAEF,SAAS,6BAA6B,CACpC,IAAU,EACV,GAAqB,EACrB,OAA6B;IAE7B,MAAM,UAAU,GAAG,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEvD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAA,gBAAM,EAAC,GAAG,EAAE;YACV,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;QACpC,IAAA,gBAAM,EACJ,GAAG,EACH;YACE,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,MAAM;SACb,EACD,CAAC,IAAA,6BAAmB,EAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB,EAAE,OAA6B;IAC3E,OAAO,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,OAA6B;IAC1E,OAAO,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;AAC7E,CAAC"}

package/lib/S6303/index.d.ts

@@ -0,0 +1 @@
+export { rule } from './rule';

package/lib/S6303/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+var rule_1 = require("./rule");
+Object.defineProperty(exports, "rule", { enumerable: true, get: function () { return rule_1.rule; } });
+//# sourceMappingURL=index.js.map

package/lib/S6303/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../S6303/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+BAA8B;AAArB,4FAAA,IAAI,OAAA"}

package/lib/S6303/meta.json

@@ -0,0 +1,9 @@
+{
+    "type": "problem",
+    "docs": {
+        "description": "Using unencrypted RDS DB resources is security-sensitive",
+        "recommended": true,
+        "url": "https://sonarsource.github.io/rspec/#/rspec/S6303/javascript",
+        "requiresTypeChecking": false
+    }
+}

package/lib/S6303/rule.d.ts

@@ -0,0 +1,2 @@
+import { Rule } from 'eslint';
+export declare const rule: Rule.RuleModule;

package/lib/S6303/rule.js

@@ -0,0 +1,107 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S6303/javascript
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const helpers_1 = require("../helpers");
+const cdk_1 = require("../helpers/aws/cdk");
+const meta_json_1 = __importDefault(require("./meta.json"));
+const CfnDBCluster = 'CfnDBCluster';
+const CfnDBInstance = 'CfnDBInstance';
+const DatabaseCluster = 'DatabaseCluster';
+const DatabaseClusterFromSnapshot = 'DatabaseClusterFromSnapshot';
+const DatabaseInstance = 'DatabaseInstance';
+const DatabaseInstanceReadReplica = 'DatabaseInstanceReadReplica';
+exports.rule = (0, cdk_1.AwsCdkTemplate)({
+    'aws-cdk-lib.aws_rds.CfnDBCluster': checkStorage(CfnDBCluster),
+    'aws-cdk-lib.aws_rds.CfnDBInstance': checkStorage(CfnDBInstance),
+    'aws-cdk-lib.aws_rds.DatabaseCluster': checkStorage(DatabaseCluster),
+    'aws-cdk-lib.aws_rds.DatabaseClusterFromSnapshot': checkStorage(DatabaseClusterFromSnapshot),
+    'aws-cdk-lib.aws_rds.DatabaseInstance': checkStorage(DatabaseInstance),
+    'aws-cdk-lib.aws_rds.DatabaseInstanceReadReplica': checkStorage(DatabaseInstanceReadReplica),
+}, (0, helpers_1.generateMeta)(meta_json_1.default, {
+    messages: {
+        unsafe: 'Make sure that using unencrypted storage is safe here.',
+        omitted: 'Omitting storageEncrypted disables RDS encryption. Make sure it is safe here.',
+    },
+}));
+const PROPS_ARGUMENT_POSITION = 2;
+function checkStorage(storage) {
+    return (expr, ctx) => {
+        const argument = expr.arguments[PROPS_ARGUMENT_POSITION];
+        const props = (0, helpers_1.getValueOfExpression)(ctx, argument, 'ObjectExpression');
+        if (isUnresolved(argument, props)) {
+            return;
+        }
+        if (props === undefined) {
+            report(expr.callee, 'omitted');
+            return;
+        }
+        if (isException(storage, props)) {
+            return;
+        }
+        const propertyKey = (0, helpers_1.getProperty)(props, 'storageEncrypted', ctx);
+        if (propertyKey === null) {
+            report(props, 'omitted');
+        }
+        if (!propertyKey) {
+            return;
+        }
+        const propertyValue = (0, helpers_1.getUniqueWriteUsageOrNode)(ctx, propertyKey.value);
+        if ((0, helpers_1.isFalseLiteral)(propertyValue)) {
+            report(propertyKey.value, 'unsafe');
+            return;
+        }
+        function isUnresolved(node, value) {
+            return node?.type === 'Identifier' && !(0, helpers_1.isUndefined)(node) && value === undefined;
+        }
+        function isException(storage, props) {
+            if (![
+                DatabaseCluster,
+                DatabaseClusterFromSnapshot,
+                DatabaseInstance,
+                DatabaseInstanceReadReplica,
+            ].includes(storage)) {
+                return false;
+            }
+            const exceptionKey = (0, helpers_1.getProperty)(props, 'storageEncryptionKey', ctx);
+            if (exceptionKey == null) {
+                return false;
+            }
+            const exceptionValue = (0, helpers_1.getUniqueWriteUsageOrNode)(ctx, exceptionKey.value);
+            if (exceptionValue.type !== 'NewExpression') {
+                return false;
+            }
+            const fqn = (0, cdk_1.normalizeFQN)((0, helpers_1.getFullyQualifiedName)(ctx, exceptionValue.callee));
+            return fqn === 'aws_cdk_lib.aws_kms.Key' || fqn === 'aws_cdk_lib.aws_kms.Alias';
+        }
+        function report(node, messageId) {
+            ctx.report({
+                messageId,
+                node,
+            });
+        }
+    };
+}
+//# sourceMappingURL=rule.js.map

package/lib/S6303/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../S6303/rule.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAA+D;;;;;;AAG/D,wCAQoB;AAGpB,4CAAkE;AAClE,4DAAoC;AAEpC,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAClE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAErD,QAAA,IAAI,GAAoB,IAAA,oBAAc,EACjD;IACE,kCAAkC,EAAE,YAAY,CAAC,YAAY,CAAC;IAC9D,mCAAmC,EAAE,YAAY,CAAC,aAAa,CAAC;IAChE,qCAAqC,EAAE,YAAY,CAAC,eAAe,CAAC;IACpE,iDAAiD,EAAE,YAAY,CAAC,2BAA2B,CAAC;IAC5F,sCAAsC,EAAE,YAAY,CAAC,gBAAgB,CAAC;IACtE,iDAAiD,EAAE,YAAY,CAAC,2BAA2B,CAAC;CAC7F,EACD,IAAA,sBAAY,EAAC,mBAA8B,EAAE;IAC3C,QAAQ,EAAE;QACR,MAAM,EAAE,wDAAwD;QAChE,OAAO,EAAE,+EAA+E;KACzF;CACF,CAAC,CACH,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CAAC,IAA0B,EAAE,GAAqB,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,IAAA,8BAAoB,EAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,qBAAW,EAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAA,mCAAyB,EAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,IAAA,wBAAc,EAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,SAAS,YAAY,CAAC,IAA6B,EAAE,KAAqC;YACxF,OAAO,IAAI,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,IAAA,qBAAW,EAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC;QAClF,CAAC;QAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAA8B;YAClE,IACE,CAAC;gBACC,eAAe;gBACf,2BAA2B;gBAC3B,gBAAgB;gBAChB,2BAA2B;aAC5B,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnB,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,qBAAW,EAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;YACrE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,IAAA,mCAAyB,EAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,cAAc,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,IAAA,+BAAqB,EAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,GAAG,KAAK,yBAAyB,IAAI,GAAG,KAAK,2BAA2B,CAAC;QAClF,CAAC;QAED,SAAS,MAAM,CAAC,IAAiB,EAAE,SAAiB;YAClD,GAAG,CAAC,MAAM,CAAC;gBACT,SAAS;gBACT,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/lib/S6304/index.d.ts

@@ -0,0 +1 @@
+export { rule } from './rule';

package/lib/S6304/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+var rule_1 = require("./rule");
+Object.defineProperty(exports, "rule", { enumerable: true, get: function () { return rule_1.rule; } });
+//# sourceMappingURL=index.js.map

package/lib/S6304/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../S6304/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+BAA8B;AAArB,4FAAA,IAAI,OAAA"}

package/lib/S6304/meta.json

@@ -0,0 +1,9 @@
+{
+    "type": "problem",
+    "docs": {
+        "description": "Policies granting access to all resources of an account are security-sensitive",
+        "recommended": false,
+        "url": "https://sonarsource.github.io/rspec/#/rspec/S6304/javascript",
+        "requiresTypeChecking": false
+    }
+}

package/lib/S6304/rule.d.ts

@@ -0,0 +1,2 @@
+import { Rule } from 'eslint';
+export declare const rule: Rule.RuleModule;

package/lib/S6304/rule.js

@@ -0,0 +1,76 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S6304/javascript
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const helpers_1 = require("../helpers");
+const result_1 = require("../helpers/result");
+const iam_1 = require("../helpers/aws/iam");
+const meta_json_1 = __importDefault(require("./meta.json"));
+const MESSAGES = {
+    message: 'Make sure granting access to all resources is safe here.',
+    secondary: 'Related effect',
+};
+const KMS_PREFIX = 'kms:';
+exports.rule = (0, iam_1.AwsIamPolicyTemplate)(allResourcesAccessibleStatementCheck, (0, helpers_1.generateMeta)(meta_json_1.default, {
+    schema: [
+        {
+            // internal parameter for rules having secondary locations
+            enum: [helpers_1.SONAR_RUNTIME],
+        },
+    ],
+}));
+function allResourcesAccessibleStatementCheck(expr, ctx, options) {
+    const properties = (0, result_1.getResultOfExpression)(ctx, expr);
+    const effect = (0, iam_1.getSensitiveEffect)(properties, ctx, options);
+    const resource = getSensitiveResource(properties, options);
+    if (isException(properties, options)) {
+        return;
+    }
+    if (effect.isMissing && resource) {
+        (0, helpers_1.report)(ctx, {
+            message: MESSAGES.message,
+            node: resource,
+        });
+    }
+    else if (effect.isFound && resource) {
+        (0, helpers_1.report)(ctx, {
+            message: MESSAGES.message,
+            node: resource,
+        }, [(0, helpers_1.toSecondaryLocation)(effect.node, MESSAGES.secondary)]);
+    }
+}
+function isException(properties, options) {
+    return properties.getProperty(options.actions.property).everyStringLiteral(isKmsAction);
+}
+function isKmsAction(action) {
+    return action.value.startsWith(KMS_PREFIX);
+}
+function getSensitiveResource(properties, options) {
+    return getSensitiveResources(properties, options).find(iam_1.isAnyLiteral);
+}
+function getSensitiveResources(properties, options) {
+    return properties.getProperty(options.resources.property).asStringLiterals();
+}
+//# sourceMappingURL=rule.js.map